Vulnerability Development mailing list archives

Re: How do web servers handle dropped connections?


From: mock () ACTIVESTATE COM
Date: Mon, 28 Aug 2000 01:08:19 -0700

On Fri, Aug 25, 2000 at 08:40:16PM +0200, Walter Hop wrote:
Hi,

looking at the stars last night I was wondering: if I request a scripted
page /blah.pl from a webserver, the server starts the perl interpreter and
runs the script. What happens when the browser breaks the connection
with the web server before the script has finished? Is the script allowed
to execute fully and is the output being discarded afterwards, or is the
process killed immediately? In other words, can server side scripts be
aborted prematurely in this way - and for example corrupt open files or
leave inconsistencies in a database?

This condition is probably considered by web server authors long ago, but
I can't find any info on the subject (and am not great in C)..


In the case of perl.exe with IIS, I'm fairly sure the script carries on, at
least it appears to in the (few) quick tests I just did.  Output to stdout is
discarded, however since the script is still running it should still be able
to send data to any other file handles it has open.  So to answer your question
I don't believe the possibility for corrupting files or databases exists,
however one could probably take advantage of long running perl scripts to
DoS the server if it isn't correctly set up to limit this.  I will query the
ActivePerl and PerlEx developers to make sure that's the case with PerlIS.dll
and PerlEx.dll as well.

mock


Current thread: