Due to conflicting results in some tests, I believe that my
previous post regarding this issue contained some inaccurate
statements:
The root cause of this vulnerability is not a sudden flood of
connections; the issue appears to be that Xitami 2.5 Beta does
not "clean up" the resources of a connection that has been
broken/closed in some cases. As a result, the vulnerability can
be triggered simply by heavy traffic.
Unsetting a limit you may have on HTTP connections will not
avoid this vulnerability, and could worsen the affects of any
actual overload. However, systems with limits set will exceed
those limits more quickly.
The vulnerability appears to be present in the way Xitami
handles Keep-Alive connections. Specifically, the server will
not close Keep-Alive connections even when appropriate
timeouts have been set.
"The reason the mainstream is thought
of as a stream is because it is
so shallow."
- Author Unknown
---------------------------------------------------------------------
This message (including any attachments) contains confidential
information intended for a specific individual and purpose, and
is protected by law. If you are not the intended recipient, you
should delete this message and are hereby notified that any
disclosure, copying, or distribution of this message, or the taking
of any action based on it, is strictly prohibited.
_______________________________________________
Full-Disclosure - We believe in it.
Full-Disclosureat_private
http://lists.netsys.com/mailman/listinfo/full-disclosure
This archive was generated by hypermail 2b30 : Mon Aug 05 2002 - 23:33:20 PDT