Re: [cobalt-security] RaQ3 and Apache DoS

[Tom Worley <raq@xxxxxxxxxxxx>]

On Thursday 20 June 2002 4:19 pm, Chad wrote:
> Just wanted to confirm (and verifiy) to the list that
> it's in the wild...

Great, just what we needed.

> We have a few RaQ3's running the standard fare Apache
> 1.3.6 (shame, shame) in our racks.. One has been hit
> by two DoS attacks in the last 72 hours... First HTTP
> stops responding, then followed a few mins later by
> other services starting to fail as well... Within
> about 5-10 mins everything goes tits-up...
> The solution, reboot the box..

Hmmm, more fun :(

> No entries in the logs except the one that Michael
> noted which shows up in the error log as a "child pid
> exit signal Segmentation fault"

<snip>

> COBALT/SUN - We need some confirmation that someone is
> working on a fix and quick... (PLEASE)... This could
> get REALLY NASTY REALLY QUICK..!!!

Yeah, I've asked one of the guys at Sun/Cobalt if he knows if they are 
bringing out a patch, and I posted it here, but no reply so far (ok, I'm in 
the UK and they're probably -8 hours, but if I hear anything I'll let people 
know).
Please let us know if you're working on this, and a rough ETA please 
Sun/Cobalt.
 
Regards,
Tom Worley
Worley Web Solutions
http://www.uk2raq.com
http://www.worleyweb.net
http://www.totalannihilation2.com
http://projectmist.org