OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Russ (Russ.CooperRC.ON.CA)
Date: Tue Apr 09 2002 - 13:03:54 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Several respondents all concurred, this isn't a bug in IIS.

    Azubi IFK LabTec <Azubi.IFKmt.com> said;

    >Why should that be a bug?
    >
    >You would like IIS to respond like http://server_ip:80/test/ (same
    >as: http://server_ip/test/) and if IIS would respond with such a
    >Redirect URL, that would be a bug! IIS just knows he's on port 79...
    >and there's no file called /test...so now he needs to redirect you...
    >but he cannot redirect you just to /test/ he needs to send you the
    >real domain...
    >
    >The Domain IS server_ip with port 79
    >
    >IIS is working fine...
    >
    >Anything different would be a mistake.

    Raymond Zwarts <raymond.zwartslostboys.nl> said;

    >First of all, I think the 'flamuko' is a typo in you message and should
    >have read test as well.
    >
    >If that assumption is correct then all the behaviour you are describing
    >is standard behaviour observed by all webservers. How is IIS to know
    >that you are redirecting traffic?
    >
    >Port tunnel should (or could) re-write the Location string which is
    >sent back to the user, but IIS can't if it doesn't know about the
    >redirect.

    Eric Chamberlain <echambersocrates.Berkeley.EDU> said;

    >I would not call this a bug in IIS. IIS has no way of knowing that you
    >are basically doing PAT and changing the port. IIS is issuing the URL
    >with the correct port, based on the inbound port. Remember that if
    there
    >is no port number displayed, it is really FQDN:80.
    >
    >What you are asking is that for an inbound request on port 79, the
    >server should reply with port 80, when to the server, no service exists
    >on port 80.
    >
    >If there is a bug, it is in the SteelBytes product, it should be
    >checking for port numbers on the returned URL and changing the URL to
    >the redirected port.

    Cheers,
    Russ - NTBugtraq Editor