| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <001101c23c05$b0510d00$e62d1c41@kc.rr.com>
From: mattmurphy at kc.rr.com (Matthew Murphy)
Subject: Clarification on Xitami DoS
Due to conflicting results in some tests, I believe that my
previous post regarding this issue contained some inaccurate
statements:
The root cause of this vulnerability is not a sudden flood of
connections; the issue appears to be that Xitami 2.5 Beta does
not "clean up" the resources of a connection that has been
broken/closed in some cases. As a result, the vulnerability can
be triggered simply by heavy traffic.
Unsetting a limit you may have on HTTP connections will not
avoid this vulnerability, and could worsen the affects of any
actual overload. However, systems with limits set will exceed
those limits more quickly.
The vulnerability appears to be present in the way Xitami
handles Keep-Alive connections. Specifically, the server will
not close Keep-Alive connections even when appropriate
timeouts have been set.
"The reason the mainstream is thought
of as a stream is because it is
so shallow."
- Author Unknown
---------------------------------------------------------------------
This message (including any attachments) contains confidential
information intended for a specific individual and purpose, and
is protected by law. If you are not the intended recipient, you
should delete this message and are hereby notified that any
disclosure, copying, or distribution of this message, or the taking
of any action based on it, is strictly prohibited.
Powered by blists - more mailing lists