Hi all,

I found out that a very easy to make malformed get request causes my IIS
servers to crash or stop serving.  This applies both to an old IIS3
installation and a server with version 4 and service pack 5.

A bug in a self-written application generated, in a certain situation, a
request like:

http://www.myserver.com/cgi-bin/someapplication.pl?ID=1&ID=2&ID=3&ID=4&ID=5
(and so on, until ID=313).
Instead of giving a http error "Malformed request", IIS3 (inetinfo.exe)
crashes and IIS4 silently stops all individual web sites, not stopping the
WWW service on a services level or crashing inetinfo.exe.

I found out, that it isn't the perl wrapper causing the problem, since a
similar query string  in a request for a random, or even non-existing HTML
file does the same.

Now I did find a knowledge base article that, as usually with knowledge base
articles, to my feeling only touches the subject; I have the idea that it
actually is about another problem:

http://support.microsoft.com/support/kb/articles/Q238/3/49.ASP

As far as I understand this article, it's about a specially malformed http
header, not about a malformed query string, and also I have no indications
of excessive memory consumption on such a request, like describes in the
article.  What do you think?  Is this article about my problem or not?  And
do others of you know of this problem and a possible solution (other than
avoiding that applications produce such a request, after all, anyone who
wants to do wrong can as easy as described shut down my server)?

Thanks in advance for answering,

Koen Kamphuys

• Web Designer Courses
• Off the Shelf Training Courses

HWG: hwg-servers mailing list archives, maintained by Webmasters @ IWA