I am happy that it is all working good for you. I have been an ISP for 7 years now Started with IIS-3 now running IIS-5 Clustered/Load Balancing with a backend SQL with IMAIL. I look at all the post here on Imail And I can just say one thing Imail works Great!!. For me Alot better than Sendmail ever did. Just stared playing with .NET framework Cool stuff. Knock on wood never been down for a hole! PS I run an Apache server two for the non MS Folks.
Nice talking to ya Paul -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of The Innkeeper Sent: Friday, April 19, 2002 11:21 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] IIS WEB Messaging NP on the fun side Paul...ASP is handled very well in WSPro and I have had no problems at all recently...In version 2.x you had problems with running things in NT User Context.....with V3.x that problem has been taken care of....I cannot run the laest and greatest of the ASP code but what I run takes care of what the customer needs :-) As far as Apache goes I am running this for folks who have no need of anything that deals with M$....It runs PHP just great (as does WSPro) but no Front Page or ASP stuff is on the Apache Server...This is a slick Web Server that doesn't require any stuff beyond what is freely available.... > How do you manage ASP code with WebSite Pro? > Apache you need to run Wrappers and Chilly soft Yuck :-) > To keep the Demons out > > This is just for fun Now don't get mad > > > I said Apache 2.x first off.....Second off the space you have used on Apache > Security Problems would be MUCH larger with IIS Holes.... > > I am not saying that any Web Server is immune to holes (though WebSite Pro > is pretty good)...I am saying that IIS has new holes each and every day (or > at least it seems that way)... > > > > Now come on now > > Here is a small list from Apache Bug list > > > > Fixed in Apache httpd 1.3.24 > > Win32 Apache Remote command execution CAN-2002-0061 > > Apache for Win32 before 1.3.24 and 2.0.34-beta allows remote attackers to > > execute arbitrary commands via parameters passed to batch file CGI > scripts. > > > > > > Fixed in Apache httpd 1.3.22 > > Requests can cause directory listing to be displayed CAN-2001-0729 > > A vulnerability was found in the Win32 port of Apache 1.3.20. A client > > submitting a very long URI could cause a directory listing to be returned > > rather than the default index page. > > > > split-logfile can cause arbitrary log files to be written to CAN-2001-0730 > > A vulnerability was found in the split-logfile support program. A request > > with a specially crafted Host: header could allow any file with a .log > > extension on the system to be written to. > > > > Multiviews can cause a directory listing to be displayed CAN-2001-0731 > > A vulnerability was found when Multiviews are used to negotiate the > > directory index. In some configurations, requesting a URI with a > > QUERY_STRING of M=D could return a directory listing rather than the > > expected index page. > > > > > > Fixed in Apache httpd 1.3.20 > > Denial of service attack on Win32 and OS2 > > A vulnerability was found in the Win32 and OS2 ports of Apache 1.3. A > client > > submitting a carefully constructed URI could cause a General Protection > > Fault in a child process, bringing up a message box which would have to be > > cleared by the operator to resume operation. This vulnerability introduced > > no identified means to compromise the server other than introducing a > > possible denial of service. > > > > > > Fixed in Apache httpd 1.3.19 > > Requests can cause directory listing to be displayed CAN-2001-0925 > > The default installation can lead mod_negotiation and mod_dir or > > mod_autoindex to display a directory listing instead of the multiview > > index.html file if a very long path was created artificially by using many > > slashes. > > > > > > Fixed in Apache httpd 1.3.14 > > Rewrite rules that include references allow access to any file > CVE-2000-0913 > > The Rewrite module, mod_rewrite, can allow access to any file on the web > > server. The vulnerability occurs only with certain specific cases of using > > regular expression references in RewriteRule directives. If the > destination > > of a RewriteRule contains regular expression references then an attacker > > will be able to access any file on the server. > > > > Mass virtual hosting allows access to any file > > A security problem exists in the handling of Host: headers in mass virtual > > hosting configurations. Under certain circumstances an attacker can access > > any file on the server. > > > > Mass virtual hosting can display CGI source > > A security problem for users of the mass virtual hosting module, > > mod_vhost_alias, causes the source to a CGI to be sent if the cgi-bin > > directory is under the document root. However, it is not normal to have > your > > cgi-bin directory under a document root. > > > > Requests can cause directory listing to be displayed on NT CVE-2000-0505 > > A security hole on NT allows a user to view the listing of a directory > > instead of the default HTML page by sending a carefully constructed > request. > > > > > > Fixed in Apache httpd 1.3.12 > > Cross-site scripting can reveal private session information > > Apache was vulnerable to cross site scripting issues. It was shown that > > malicious HTML tags can be embedded in client web requests if the server > or > > script handling the request does not carefully encode all information > > displayed to the user. Using these vulnerabilities attackers could, for > > example, obtain copies of your private cookies used to authenticate you to > > other sites. > > > > > > Fixed in Apache httpd 1.3.11 > > Mass virtual hosting security issue > > A security problem can occur for sites using mass name-based virtual > hosting > > (using the new mod_vhost_alias module or with special mod_rewrite rules). > > > > > > Fixed in Apache httpd 1.3.4 > > Denial of service attack on Win32 > > There have been a number of important security fixes to Apache on Windows. > > The most important is that there is much better protection against people > > trying to access special DOS device names (such as "nul"). > > > > > > Fixed in Apache httpd 1.3.2 > > Multiple header Denial of Service vulnerability CAN-1999-1199 > > A serious problem exists when a client sends a large number of headers > with > > the same header name. Apache uses up memory faster than the amount of > memory > > required to simply store the received data itself. That is, memory use > > increases faster and faster as more headers are received, rather than > > increasing at a constant rate. This makes a denial of service attack based > > on this method more effective than methods which cause Apache to use > memory > > at a constant rate, since the attacker has to send less data. > > > > Denial of service attacks > > Apache 1.3.2 has better protection against denial of service attacks. > These > > are when people make excessive requests to the server to try and prevent > > other people using it. In 1.3.2 there are several new directives which can > > limit the size of requests (these directives all start with the word > Limit). > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]]On Behalf Of The Innkeeper > > Sent: Friday, April 19, 2002 9:17 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [IMail Forum] IIS WEB Messaging > > > > > > > I have a question/ Thought. > > > > > > We all know the issues with web messaging. Why does IPSWITCH continue to > > > build their own web messing server. Why not just write code to operate > > > through IIS. > > > > A few thoughts on this one: > > > > 1) IIS is full of Security Holes (10 new ones just announced) > > > > 2) Apache just released 2.x for NT that is Native Win32 > > > > 3) Many folks use things other than IIS (I use WebSite Pro) > > > > > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > to be removed from this list. > > An Archive of this list is available at: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Please visit the Knowledge Base for answers to frequently asked > questions: http://www.ipswitch.com/support/IMail/ > > > Please visit http://www.ipswitch.com/support/mailing-lists.html > to be removed from this list. > > An Archive of this list is available at: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Please visit the Knowledge Base for answers to frequently asked > questions: http://www.ipswitch.com/support/IMail/ > Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
