Status/Resolution/Reason: Closed/Withdrawn/Duplicate
Reporter/Name(from Bugbase): Nikolas Stephens / Nikolas Stephens (Nikolas Stephens)
Created: 02/01/2013
Components: Web Container (Tomcat)
Versions: 10.0
Failure Type: Crash
Found In Build/Fixed In Build: Final /
Priority/Frequency: Critical / Some users will encounter
Locale/System: English / Win 2008 Server R2 64 bit
Vote Count: 7
Duplicate ID: CF-3488063
Problem Description:
When setting the 404 url in IIS to use a ColdFusion file, we get hanging requests when our PCI compliance scanner scans our application. This happens on certain GET requests to 404'd paths, where content-length request header is greater than 0.
Steps to Reproduce:
STEP 1 - Install ColdFusion 10 on a clean installation of Microsoft Windows Server 2008 R2. Make sure to install the CF 10 mandatory update and the most recent CF update 7.
STEP 2 - Configure CF connector for IIS using default settings and procedures as outline by Adobe's installation guides.
STEP 3 - Set the 404 handler in IIS for the Default Web Site to point to a ColdFusion file. For example, this is the line from my applicationHost.config file for IIS 7.5:
<error path="/404.cfm" prefixLanguageFilePath="" responseMode="ExecuteURL" statusCode="404" />
You can use an EMPTY 404.cfm file for this example.
STEP 4 - Download and install the Nessus Vulnerability scanner on any workstation you have available. http://www.tenable.com/products/nessus
STEP 5 - Type in the URL of the site you configured in Steps 1 + 2, and choose a PCI compliance scan.
STEP 6 - After the test is underway for about 10 minutes, you will begin to see a small handful of 404 requests hanging. Not all 404 requests, just certain ones that appear to have a content-length request header greater than 0. We are using FusionReactor to monitor the server.
Actual Result:
These requests will never end, and eventually enough of them will pile up that your all your active requests are used up and any further requests to the server will just get queued. Effectively a denial of service....
Expected Result:
Requests should complete normally as all other 404 requests do.
Any Workarounds:
Currently, the only way to mitigate this is by using the connectionTimeout setting in the AJP connector in server.xml:
<Connector port="8012" protocol="AJP/1.3" redirectPort="8445" tomcatAuthentication="false" maxThreads="500" connectionTimeout="60000" />
This will terminate the hanging requests after 60 seconds. HOWEVER, this is NOT a solution, as if you happen to get more than 10 of these requests in a minute (the Default), your server will STILL go down.
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 3494728
External Customer Info:
External Company:
External Customer Name: Nik S.
External Customer Email:
External Test Config: My Hardware and Environment details:
Windows Server 2008 R2
VMware host, 2cpu, 6GB RAM
IIS 7.5
ColdFusion 10, Update 7Attachments:
Comments: