Xitami-2.4d4.dos.txt

`+++>===] Written by Nemesystm, member of the DHC [===<+++  
++++>==] Visit us at dhc1.cjb.net You want 2 [==<++++  
  
Subject: Xitami 2.4d4 win95/98 DoS  
Description program: Xitami is a HTTP Server with a FTP daemon, etc.  
Description DoS: Simply by connecting and disconnecting to a port Xitami   
opens, you can completely lock up the server.  
  
<-[what was used]->  
Xitami 2.4d4 for Windows 95/98 downloaded from tucows.com  
Installed with the typical installation, no standard settings changed.  
This problem worked on: Windows 98 + IE5.0 and Windows NT 4.0 SP5  
Xitami 2.4d6 (current version, same settings, not tested in WinNT no problem   
in W98)  
Xitami 2.5d2 Beta (version to come up, not tested in WinNT no problem W98)  
  
<-[how to create the problem]->  
telnet to victim.com 81  
or whatever you feel like to connect to port 81.  
then just hit enter or disconnect. Either way, on the server side the error   
"assertion failed!" shows up, and as long as it's there, no connection whatsoever   
can be made to the HTTP service nor the FTP Service nor port 81 (where LWRP   
listens on, for a description on what that is, see the documentation that   
comes with Xitami)  
The message says: "Module E:\IMATIX\DEVELOP\SMT\XILRWP.C, line 265"  
You then get three choices: Abort, Retry and Ignore. Retry and Ignore make   
it that you can continue without a problem, (even though the server was   
unreachable for as long as the error message was there), Abort however kills   
the server and gives a Microsoft Visual C++ Runtime error. (abnormal program   
termination).  
  
<-[so what]->  
This might not seem to be a big problem at first: just check the monitor   
every once in a while, but what if you're not working? What if it's weekend?   
What if it's at night? There's no telling how many people weren't able to   
see the site while you're gone.  
  
<-[logs]->  
The logs show nothing spectacular.  
console.log in /logs says:  
2000/01/14/11:23:45: xilrwp: Peer failed to connect (ERROR: Malformed startup   
string)  
xitami.log shows something similar.  
No IP addresses from the culprit. 8-)  
  
<-[fix]->  
Well, I waited with this till the new version was out. The new one doesn't   
have the problem, nor does the beta version. I suggest getting that, or   
making sure no connections to port 81 are allowed.  
It's available at www.imatix.com.  
  
Greetz,  
nemesystm, leader of the DHC (dhc1.cjb.net)  
  
>>>The End<<<  
[email protected] for questions.  
  
`