OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Bob at firstcodings (bobfirstcodings.net)
Date: Tue Dec 18 2001 - 13:24:52 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

     Hi.

    Here is my OnPreprocHeaders callback :

    DWORD CBlockHeaderFilter::OnPreprocHeaders(CHttpFilterContext* pCtxt,
     PHTTP_FILTER_PREPROC_HEADERS pHeaderInfo)
    {
     pCtxt->AddResponseHeaders("X-CustomDebug: OnPreprocHeaders\r\n", 0);
     pHeaderInfo->SetHeader( pCtxt->m_pFC, "Content-Length:", "");
     return SF_STATUS_REQ_NEXT_NOTIFICATION;
    }

    This piece of code always remove the "Content-Length" header; I think it
    works (tested on my box), but I don't know how IIS reacts when there is no
    more "Content-Length" client header. What is it used for ?
    Could someone tell me ?

    By the way, the following callback seems to reproduce the exploit
    (http://www.securityfocus.com/cgi-bin/vulns-item.pl?section=exploit&id=3667)
    :

    DWORD CBlockHeaderFilter::OnPreprocHeaders(CHttpFilterContext* pCtxt,
     PHTTP_FILTER_PREPROC_HEADERS pHeaderInfo)
    {
     pHeaderInfo->SetHeader( pCtxt->m_pFC, "Content-Length:", "5300643");
     return SF_STATUS_REQ_NEXT_NOTIFICATION;
    }

    Bob.