Security Incidents mailing list archives
RE: IIS (Possible DoS floating around)
From: "Keith.Morgan" <Keith.Morgan () Terradon com>
Date: Mon, 12 Nov 2001 13:18:27 -0500
I've fully reviewed all event logs, webserver logs, IDS and firewall logs for the day of the crash. I can't find a cause, only a symptom. Here is an exerpt from the w3svc logs: 2001-11-10 15:41:27 remoteip - localip 80 GET /index.cfm Out-of-process+ISAPI+extension+request+failed. 500 Mozilla/4.0+(c ompatible;+MSIE+5.5;+AOL+6.0;+Windows+98;+Win+9x+4.90) At least in the incidents with which I'm familiar, at least the w3svc, ftpsvc, and cold fusion are running on the machines. There was a *possible* time co-incidence with an FTP connection that (according to the log entries) dropped with an error.
-----Original Message----- From: Mike Shaw [mailto:mshaw () wwisp com] Sent: Monday, November 12, 2001 1:03 PM To: Keith.Morgan; 'incidents () securityfocus com' Subject: Re: IIS (Possible DoS floating around) Any further info on system configurations? ISAPI mappings, installed software (perl, cold fusion...), running services? -Mike At 12:27 PM 11/12/2001 -0500, Keith.Morgan wrote:The focus-ms list is hopping a little regarding some strangebehaviour fromIIS. The symptoms: IIS continues to run (or sometimes crashes), but the commonthread is thatthe port is closed. After recieving a report on focus-ms, and having this samebehaviour occuron one of our webservers, I contacted a friend who runs a(logically) nearbynetwork. He indicated that the same problem had occurred onsome of thierservers. I'm currently pouring over logs attempting to locateanything out of theordinary. Just a note for all those that will say "make sure you'veapplied patches orrun the hfnetchk:" Our servers are at completely currentpatch levels.Keith T. Morgan Chief of Information Security Terradon Communications keith.morgan () terradon com 304-755-8291 x142 ----------------------------------------------------------------------------This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- IIS (Possible DoS floating around) Keith.Morgan (Nov 12)
- Re: IIS (Possible DoS floating around) Mike Shaw (Nov 12)
- <Possible follow-ups>
- RE: IIS (Possible DoS floating around) Keith.Morgan (Nov 12)
- Re: IIS (Possible DoS floating around) Shoten (Nov 12)
- Re: IIS (Possible DoS floating around) Ezequiel Diaz-Pacheco (Nov 12)
- Re: IIS (Possible DoS floating around) Shoten (Nov 12)
- RE: IIS (Possible DoS floating around) Keith.Morgan (Nov 12)