Click here to get back home

Possible IIS Breakin - Lsass error when sent web request.
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Possible IIS Breakin - Lsass error when sent web request. c_koeber 09-01-2005
Posted by c_koeber on September 1, 2005, 2:32 pm
Please log in for more thread options
 Dear All,
I have an issue with one of my servers running Windows 2003 Server

SP1 crashing with an lsass error:
("The instruction at "0x742ea411" referenced memory at "0x0000000c".
The memory could not be "read")


I believe I narrowed the problem down to the website that I have
running on port 80. The reason is because the time frame of the errors
and the requests all come around the same time. Below is a portion of
my log with all of the bad requests. (Extended W3C - All Options
Checked). I noticed that ALL the bad requests com from the same primary

carrier - Comcast - and that they all come from some computer systems
in the Maryland area. This particular request baffles me, because I
banned this ip address before, so I don't understand why it could of
messed me up.


-----This is the bad request-----------
2005-08-31 03:47:27 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
68.33.94.180 HTTP/1.0 - - - 68.33.170.14 403 6 64 0 5697 343
-----End Bad Request-------------------


2005-08-31 04:02:45 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
68.145.171.147 HTTP/1.0 - - - 68.33.170.14 500 0 64 0 5697 406
2005-08-31 04:17:21 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
68.33.94.180 HTTP/1.0 - - - 68.33.170.14 403 6 64 0 5697 125
2005-08-31 04:25:34 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
68.33.25.206 HTTP/1.0 - - - 68.33.170.14 403 6 64 0 5697 93


I solved an lsass issue I had before with a firewall setup, but I need
port 80 open (of course)


My question is what I should do?


Anything will help


Sincerely,
Christopher Koeber



Posted by Roger Abell [MVP] on September 6, 2005, 12:24 am
Please log in for more thread options
 As Bernard indicates, all but one of the IIS log entries is a normal,
non-failure, 403 rejection response.
Are you sure that the lsass problem is not just coincidental with
being alive on the network, so you are also getting the probes to
port Tcp 80 at the same time as something else ??
As you have W2k3 why have you not enabled the firewall that
is available with simple config after install of SP1 ?
You could easily make tcp 80 available to the world and have
all else that is desired restricted to a different IP scoping. Then
you would know that your problem is really originating with IIS
or not.
> Dear All,
> I have an issue with one of my servers running Windows 2003 Server
>
> SP1 crashing with an lsass error:
> ("The instruction at "0x742ea411" referenced memory at "0x0000000c".
> The memory could not be "read")
>
>
> I believe I narrowed the problem down to the website that I have
> running on port 80. The reason is because the time frame of the errors
> and the requests all come around the same time. Below is a portion of
> my log with all of the bad requests. (Extended W3C - All Options
> Checked). I noticed that ALL the bad requests com from the same primary
>
> carrier - Comcast - and that they all come from some computer systems
> in the Maryland area. This particular request baffles me, because I
> banned this ip address before, so I don't understand why it could of
> messed me up.
>
>
> -----This is the bad request-----------
> 2005-08-31 03:47:27 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
> 68.33.94.180 HTTP/1.0 - - - 68.33.170.14 403 6 64 0 5697 343
> -----End Bad Request-------------------
>
>
> 2005-08-31 04:02:45 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
> 68.145.171.147 HTTP/1.0 - - - 68.33.170.14 500 0 64 0 5697 406
> 2005-08-31 04:17:21 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
> 68.33.94.180 HTTP/1.0 - - - 68.33.170.14 403 6 64 0 5697 125
> 2005-08-31 04:25:34 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
> 68.33.25.206 HTTP/1.0 - - - 68.33.170.14 403 6 64 0 5697 93
>
>
> I solved an lsass issue I had before with a firewall setup, but I need
> port 80 open (of course)
>
>
> My question is what I should do?
>
>
> Anything will help
>
>
> Sincerely,
> Christopher Koeber
>




Posted by Bernard Cheah [MVP] on September 6, 2005, 10:11 am
Please log in for more thread options
Base on the status code, you got
403.6 - IP address rejected.

Did you specify any ip/domain name restriction ?

--
Regards,
Bernard Cheah
http://www.iis-resources.com/
http://www.iiswebcastseries.com/
http://www.msmvps.com/bernard/


> Dear All,
> I have an issue with one of my servers running Windows 2003 Server
>
> SP1 crashing with an lsass error:
> ("The instruction at "0x742ea411" referenced memory at "0x0000000c".
> The memory could not be "read")
>
>
> I believe I narrowed the problem down to the website that I have
> running on port 80. The reason is because the time frame of the errors
> and the requests all come around the same time. Below is a portion of
> my log with all of the bad requests. (Extended W3C - All Options
> Checked). I noticed that ALL the bad requests com from the same primary
>
> carrier - Comcast - and that they all come from some computer systems
> in the Maryland area. This particular request baffles me, because I
> banned this ip address before, so I don't understand why it could of
> messed me up.
>
>
> -----This is the bad request-----------
> 2005-08-31 03:47:27 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
> 68.33.94.180 HTTP/1.0 - - - 68.33.170.14 403 6 64 0 5697 343
> -----End Bad Request-------------------
>
>
> 2005-08-31 04:02:45 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
> 68.145.171.147 HTTP/1.0 - - - 68.33.170.14 500 0 64 0 5697 406
> 2005-08-31 04:17:21 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
> 68.33.94.180 HTTP/1.0 - - - 68.33.170.14 403 6 64 0 5697 125
> 2005-08-31 04:25:34 W3SVC1 KITCHEN-COMP 192.168.2.3 GET / - 80 -
> 68.33.25.206 HTTP/1.0 - - - 68.33.170.14 403 6 64 0 5697 93
>
>
> I solved an lsass issue I had before with a firewall setup, but I need
> port 80 open (of course)
>
>
> My question is what I should do?
>
>
> Anything will help
>
>
> Sincerely,
> Christopher Koeber
>




Similar ThreadsPosted
Lsass.exe error 128 September 4, 2005, 5:18 pm
LSASS access error - just started August 15, 2005, 2:28 pm
There are currently no logon servers available to service the logon request - how to fix this error? i get it when trying to access a share one hop away. April 12, 2007, 6:03 pm
un/pwd error using network profile - no error with local profile March 23, 2007, 1:23 pm
LSASS errors July 22, 2005, 10:57 am
LSASS & Kerberos Documentation July 8, 2005, 11:35 am
LSASS Memory Bug still valid? February 20, 2006, 11:05 am
How to Determine Which Service in LSASS.EXE Binds to Port X? September 27, 2007, 4:24 am
server rebooting - lsass.exe and ntdll event id 1000 and 1015 July 6, 2005, 3:04 pm
MS08-002 Vulnerability in LSASS Could Allow Local Elevation of Privilege (943485) February 1, 2008, 1:22 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap