I've fully reviewed all event logs, webserver logs, IDS and firewall logs
for the day of the crash. I can't find a cause, only a symptom. Here is an
exerpt from the w3svc logs:

2001-11-10 15:41:27 remoteip - localip 80 GET /index.cfm
Out-of-process+ISAPI+extension+request+failed. 500 Mozilla/4.0+(c
ompatible;+MSIE+5.5;+AOL+6.0;+Windows+98;+Win+9x+4.90)

At least in the incidents with which I'm familiar, at least the w3svc,
ftpsvc, and cold fusion are running on the machines. There was a *possible*
time co-incidence with an FTP connection that (according to the log entries)
dropped with an error.

> -----Original Message-----
> From: Mike Shaw [mailto:mshawwwisp.com]
> Sent: Monday, November 12, 2001 1:03 PM
> To: Keith.Morgan; 'incidentssecurityfocus.com'
> Subject: Re: IIS (Possible DoS floating around)
>
>
> Any further info on system configurations? ISAPI mappings, installed
> software (perl, cold fusion...), running services?
>
> -Mike
>
> At 12:27 PM 11/12/2001 -0500, Keith.Morgan wrote:
> >The focus-ms list is hopping a little regarding some strange
> behaviour from
> >IIS.
> >
> >The symptoms:
> >IIS continues to run (or sometimes crashes), but the common
> thread is that
> >the port is closed.
> >
> >After recieving a report on focus-ms, and having this same
> behaviour occur
> >on one of our webservers, I contacted a friend who runs a
> (logically) nearby
> >network. He indicated that the same problem had occurred on
> some of thier
> >servers.
> >
> >I'm currently pouring over logs attempting to locate
> anything out of the
> >ordinary.
> >
> >Just a note for all those that will say "make sure you've
> applied patches or
> >run the hfnetchk:" Our servers are at completely current
> patch levels.
> >
> >
> >Keith T. Morgan
> >Chief of Information Security
> >Terradon Communications
> >keith.morganterradon.com
> >304-755-8291 x142
> >
> >
> >-------------------------------------------------------------
> ---------------
> >This list is provided by the SecurityFocus ARIS analyzer service.
> >For more information on this free incident handling, management
> >and tracking system please see: http://aris.securityfocus.com
>
>

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]