The event triggered for User Agents that were longer than 200 characters, which is also Microsoft’s recommendation for maximum user agent lengths.  The vulnerability is in some http servers that will cause a buffer overflow and thus denial of service when the user agent is too long.  I found a tool described here and downloadable here to generate large http requests.  I ran this against a test web server with IIS and found that it never crashed the server even though I generated user agent string of several million characters.  Java seemed to crash on the client before I ever affected the web server.  (I did find that I received a URI too long when I put about 19,500 characters in the get statement.)  So I determined that my servers were not affected by this vulnerability.

I noticed in the events that were sent to me that the user agents all looked legitimate.  Most were between 200 and 250 characters, so they weren’t far over the limit.  They were all Internet Explorer strings with many .Net versions displayed.  So I spent some time googling user agent strings and found several good articles and sites that I have linked to below.

The User Agent is a string that is sent during an http request that provides the web server with information on the browser being used and the platform it is running on.  Microsoft provides a good summary here. You can see what the user agent of your browser is by going to:  http://whatsmyuseragent.com/ .  When I went to this site using firefox (my default browser) I received this:  Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4.  Checking my user agent from IE revealed:  Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648) I found a good article that discusses .net and the user agent string.  One point that I noticed was that .net truncates the string to 256 characters.

I also found this site that describes how to change the user agent string in various browsers.  This site is a searchable database of user agents.  And this is an interesting article on a string sniffer that collects strings into a database.  Another interesting site lists IP addresses and their known user agents and whether they are a bot or browser.

There is one problem with this trip though.  We shipped the equipment on the second of July.  It cleared customs in the middle of last week, but DHL has no idea where the stuff is now.  Hopefully we can find the equipment tomorrow, so that we have time to install before the end of the week.  I have another trip planned to our datacenter in Phoenix beginning on Sunday so it is going to be an interesting couple of weeks.  Of course my papers and finals for my online classes fall in these two weeks too.  But the experience will be good…as long as we can locate the servers.

Anyone ever come across something like this?  It is a Windows 2003 box.

To install just download uptime.exe and place it in the windows directory.  Then run it from the command line.

uptime /? will give a listing of all the options and uptime /help will give detailed instructions.

UPTIME, Version 1.01
(C) Copyright 1999, Microsoft Corporation

Uptime [server] [/s ] [/a] [/d:mm/dd/yyyy | /p:n] [/heartbeat] [/? | /help]
server  Name or IP address of remote server to process.
/s  Display key system events and statistics.
/a  Display application failure events (assumes /s).
/d:  Only calculate for events after mm/dd/yyyy.
/p:  Only calculate for events in the previous n days.
/heartbeat  Turn on/off the system's heartbeat
/? Basic usage.
/help  Additional usage information.

Uptime works by checking the windows event logs for startup and shutdown times.  Running uptime with the /s switch will provide more detailed statistics as shown below.  If the event log has been cleared or is corrupted uptime will not show correct stats.

I have found it helpful to set up .bat files with the servers I want to check. This then gives me a quick list of the uptime of various servers.  It is quite a useful command.  I’m not sure why Microsoft didn’t just stick it in the directory with all their other commands.

C:\uptime \\myserver -s

Uptime Report for: \\myserver

Current OS: Microsoft Windows Server 2003, Service Pack 2, Multiprocessor Free.
Time Zone: Eastern Daylight Time

System Events as of 6/6/2008 9:59:47 AM:

Date:      Time:        Event:               Comment:
---------- -----------  -------------------  -----------------------------------

12/2/2007  1:18:11 PM   Shutdown
12/2/2007  1:20:14 PM   Boot                 Prior downtime:0d 0h:2m:3s
12/4/2007  10:45:19 PM  Shutdown             Prior uptime:2d 9h:25m:5s
12/4/2007  10:47:23 PM  Boot                 Prior downtime:0d 0h:2m:4s
12/16/2007  9:23:16 PM  Shutdown             Prior uptime:11d 22h:35m:53s
12/16/2007  9:25:30 PM  Boot                 Prior downtime:0d 0h:2m:14s
3/1/2008  10:51:12 PM   Shutdown             Prior uptime:76d 1h:25m:42s
3/1/2008  10:54:05 PM   Boot                 Prior downtime:0d 0h:2m:53s
3/16/2008  5:04:48 PM   Shutdown             Prior uptime:14d 17h:10m:43s
3/16/2008  5:07:07 PM   Boot                 Prior downtime:0d 0h:2m:19s
4/9/2008  7:00:38 PM    Shutdown             Prior uptime:24d 1h:53m:31s
4/9/2008  7:02:47 PM    Boot                 Prior downtime:0d 0h:2m:9s
4/9/2008  7:23:35 PM    Shutdown             Prior uptime:0d 0h:20m:48s
4/9/2008  7:25:47 PM    Boot                 Prior downtime:0d 0h:2m:12s

Current System Uptime: 57 day(s), 14 hour(s), 34 minute(s), 44 second(s)

--------------------------------------------------------------------------------

Since 12/2/2007:

  System Availability: 99.9941%
  Total Uptime: 186d 19h:25m:42s
  Total Downtime: 0d 0h:15m:54s
  Total Reboots: 7
  Mean Time Between Reboots: 26.69 days
  Total Bluescreens: 0