Re: Xitami Connection Flood Server Termination Vulnerability

From: Muhammad Faisal Rauf Danka (mfrdat_private)
Date: Fri Aug 02 2002 - 18:37:25 PDT

  • Next message: NGSSoftware Insight Security Research: "[VulnWatch] Microsoft SQL Server 2000,7 OpenRowSet Buffer Overflow vulnerability (#NISR02072002)"

    I tried the same method as you suggested on Xitami 2.5b5 for Win32, 
    but my results are a bit different.
    
    I recieved following errors:
    
    Service Unavailable error 
    It Ignores session request 
    
    Although i tried it using a perl script flooding the GET requests in a
    loop, instead of using browser quickie, but yeah i had the maximum 
    number of concurrent sessions value set quiet low, as it was 100 only.
    
    But if the bug is in the method of identifying the max sessions and 
    responding to it, then it should work even if it's set as 5.
    
    So is it specific to some limit like more than $value number of
    sessions, or could it be your hardware resources running out while your
    tests?
    
    Regards, 
    ---------
    Muhammad Faisal Rauf Danka
    
    Chief Technology Officer
    Gem Internet Services (Pvt) Ltd.
    web: www.gem.net.pk
    
    _____________________________________________________________
    ---------------------------
    [ATTITUDEX.COM]
    http://www.attitudex.com/
    ---------------------------
    
    _____________________________________________________________
    Promote your group and strengthen ties to your members with emailat_private by Everyone.net  http://www.everyone.net/?btn=tag
    



    This archive was generated by hypermail 2b30 : Fri Aug 02 2002 - 19:30:59 PDT