[Helma-user] Obscure Error Messages in helma.server.log

[tobias.schaefer at orf.at]

Thanks Hannes for the explanations of the error messages.

Maybe it was just one of those so-called coïncidences. At least, there was no restarting or rebooting necessary in the meantime.
(Fingers remain crossed.)

Ciao,
tobi


-----Original Message-----
From: helma-user-bounces at helma.org on behalf of Hannes Wallnoefer
Sent: Mon 28-Jan-08 10:48
To: Helma User Mailing List
Subject: Re: [Helma-user] Obscure Error Messages in helma.server.log
 
Hi Tobi,

from what you say it may well have been a DOS attack, but the log
entries do not really give a clear indication.

The Illegal cookie thing obviously tries to use a tomcat ajp13
connector exploit:
http://issues.apache.org/bugzilla/show_bug.cgi?id=10383
I think the fact that jetty logs an error message tells us that it's
not vulnerable.

The second thing is an error that helma currently throws when there
are two cookies with the same name. This isn't that uncommon as
cookies can come with different domains and path names, so I should
look into this, i.e. it's actually a helma bug that the user gets an
error page.

Finally, the EOFException in writeResponse() just tells us that the
client has closed the connection while we were still writing to it,
i.e. not a big issue at all.

hannes
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/ms-tnef
Size: 3440 bytes
Desc: not available
Url : http://helma.org/pipermail/helma-user/attachments/20080128/bbb97406/attachment.bin