hey kettle, you sure are charred sincerely, pot
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of The Innkeeper Sent: Friday, April 19, 2002 11:51 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] IIS WEB Messaging Paul, Glad all is working well with you. I ran IIS with WSPro for awhile since a few customers wanted what IIS had. After the last shennanigan with IIS they switched to WSPro so I don't run IIS anywhere in my system now (and I am quite happy with that). Since Apache released their newest version I snagged it up quickly since I run a straight NT shop here with no Linux/BSD or anything else. I needed something that would run clean and do PHP a bit cleaner than WSPro. I have basic sites on the Apache server that require no more than basic stuff and PHP. Works well for me :-) I also run SQL (since I don't like MYSql) and IMail works great for me also. I am staying away form the .NET framework right now since it looks like it will open up a lot of holes I would rather not deal with :-) The reason I asked the other question is that I find that folks who work for others institute software that requires much maintenance...Those of us who own businesses use things that require less maintenance :-) I hope all stays well with you and the M$ stuff...I had BAD experiences with it so I eliminate as much M$ as I can in my system even though I am an NT shop :-) Steve > I am happy that it is all working good for you. I have been an ISP for 7 > years now Started with > IIS-3 now running IIS-5 Clustered/Load Balancing with a backend SQL with > IMAIL. I look at all the post here on Imail And I can just say one thing > Imail works Great!!. For me Alot better than Sendmail ever did. Just stared > playing with .NET framework Cool stuff. Knock on wood never been down for a > hole! PS I run an Apache server two for the non MS Folks. > > Nice talking to ya > > Paul > > > > NP on the fun side Paul...ASP is handled very well in WSPro and I have had > no problems at all recently...In version 2.x you had problems with running > things in NT User Context.....with V3.x that problem has been taken care > of....I cannot run the laest and greatest of the ASP code but what I run > takes care of what the customer needs :-) > > As far as Apache goes I am running this for folks who have no need of > anything that deals with M$....It runs PHP just great (as does WSPro) but no > Front Page or ASP stuff is on the Apache Server...This is a slick Web Server > that doesn't require any stuff beyond what is freely available.... > > > > How do you manage ASP code with WebSite Pro? > > Apache you need to run Wrappers and Chilly soft Yuck :-) > > To keep the Demons out > > > > This is just for fun Now don't get mad > > > > > > I said Apache 2.x first off.....Second off the space you have used on > Apache > > Security Problems would be MUCH larger with IIS Holes.... > > > > I am not saying that any Web Server is immune to holes (though WebSite Pro > > is pretty good)...I am saying that IIS has new holes each and every day > (or > > at least it seems that way)... > > > > > > > Now come on now > > > Here is a small list from Apache Bug list > > > > > > Fixed in Apache httpd 1.3.24 > > > Win32 Apache Remote command execution CAN-2002-0061 > > > Apache for Win32 before 1.3.24 and 2.0.34-beta allows remote attackers > to > > > execute arbitrary commands via parameters passed to batch file CGI > > scripts. > > > > > > > > > Fixed in Apache httpd 1.3.22 > > > Requests can cause directory listing to be displayed CAN-2001-0729 > > > A vulnerability was found in the Win32 port of Apache 1.3.20. A client > > > submitting a very long URI could cause a directory listing to be > returned > > > rather than the default index page. > > > > > > split-logfile can cause arbitrary log files to be written to > CAN-2001-0730 > > > A vulnerability was found in the split-logfile support program. A > request > > > with a specially crafted Host: header could allow any file with a .log > > > extension on the system to be written to. > > > > > > Multiviews can cause a directory listing to be displayed CAN-2001-0731 > > > A vulnerability was found when Multiviews are used to negotiate the > > > directory index. In some configurations, requesting a URI with a > > > QUERY_STRING of M=D could return a directory listing rather than the > > > expected index page. > > > > > > > > > Fixed in Apache httpd 1.3.20 > > > Denial of service attack on Win32 and OS2 > > > A vulnerability was found in the Win32 and OS2 ports of Apache 1.3. A > > client > > > submitting a carefully constructed URI could cause a General Protection > > > Fault in a child process, bringing up a message box which would have to > be > > > cleared by the operator to resume operation. This vulnerability > introduced > > > no identified means to compromise the server other than introducing a > > > possible denial of service. > > > > > > > > > Fixed in Apache httpd 1.3.19 > > > Requests can cause directory listing to be displayed CAN-2001-0925 > > > The default installation can lead mod_negotiation and mod_dir or > > > mod_autoindex to display a directory listing instead of the multiview > > > index.html file if a very long path was created artificially by using > many > > > slashes. > > > > > > > > > Fixed in Apache httpd 1.3.14 > > > Rewrite rules that include references allow access to any file > > CVE-2000-0913 > > > The Rewrite module, mod_rewrite, can allow access to any file on the web > > > server. The vulnerability occurs only with certain specific cases of > using > > > regular expression references in RewriteRule directives. If the > > destination > > > of a RewriteRule contains regular expression references then an attacker > > > will be able to access any file on the server. > > > > > > Mass virtual hosting allows access to any file > > > A security problem exists in the handling of Host: headers in mass > virtual > > > hosting configurations. Under certain circumstances an attacker can > access > > > any file on the server. > > > > > > Mass virtual hosting can display CGI source > > > A security problem for users of the mass virtual hosting module, > > > mod_vhost_alias, causes the source to a CGI to be sent if the cgi-bin > > > directory is under the document root. However, it is not normal to have > > your > > > cgi-bin directory under a document root. > > > > > > Requests can cause directory listing to be displayed on NT CVE-2000-0505 > > > A security hole on NT allows a user to view the listing of a directory > > > instead of the default HTML page by sending a carefully constructed > > request. > > > > > > > > > Fixed in Apache httpd 1.3.12 > > > Cross-site scripting can reveal private session information > > > Apache was vulnerable to cross site scripting issues. It was shown that > > > malicious HTML tags can be embedded in client web requests if the server > > or > > > script handling the request does not carefully encode all information > > > displayed to the user. Using these vulnerabilities attackers could, for > > > example, obtain copies of your private cookies used to authenticate you > to > > > other sites. > > > > > > > > > Fixed in Apache httpd 1.3.11 > > > Mass virtual hosting security issue > > > A security problem can occur for sites using mass name-based virtual > > hosting > > > (using the new mod_vhost_alias module or with special mod_rewrite > rules). > > > > > > > > > Fixed in Apache httpd 1.3.4 > > > Denial of service attack on Win32 > > > There have been a number of important security fixes to Apache on > Windows. > > > The most important is that there is much better protection against > people > > > trying to access special DOS device names (such as "nul"). > > > > > > > > > Fixed in Apache httpd 1.3.2 > > > Multiple header Denial of Service vulnerability CAN-1999-1199 > > > A serious problem exists when a client sends a large number of headers > > with > > > the same header name. Apache uses up memory faster than the amount of > > memory > > > required to simply store the received data itself. That is, memory use > > > increases faster and faster as more headers are received, rather than > > > increasing at a constant rate. This makes a denial of service attack > based > > > on this method more effective than methods which cause Apache to use > > memory > > > at a constant rate, since the attacker has to send less data. > > > > > > Denial of service attacks > > > Apache 1.3.2 has better protection against denial of service attacks. > > These > > > are when people make excessive requests to the server to try and prevent > > > other people using it. In 1.3.2 there are several new directives which > can > > > limit the size of requests (these directives all start with the word > > Limit). > > > > > > > > > > > > > > > > I have a question/ Thought. > > > > > > > > We all know the issues with web messaging. Why does IPSWITCH continue > to > > > > build their own web messing server. Why not just write code to operate > > > > through IIS. > > > > > > A few thoughts on this one: > > > > > > 1) IIS is full of Security Holes (10 new ones just announced) > > > > > > 2) Apache just released 2.x for NT that is Native Win32 > > > > > > 3) Many folks use things other than IIS (I use WebSite Pro) > > > Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
