I think I have uncovered the reason for the problem. I have managed to write a script that emulates the worm's POST requests.I think we've found it occurs regardless of IC/mod_interchange/apache version. At least in my case I've tried different versions of Apache and mod_interchange and have seen posts from people using different versions of IC (we are on modified version of 4.8.x). It'll be interesting to see if we have this same problem when we move to the latest and greatest.
The script will consistently crash our site (and presumably many other Interchange sites), so I thought it was best to send it to Kevin off list rather than post details of the script to the mailing list.
Ron/Jeff - If you wish, I can forward you a copy of the script and details of the issue.
BTW Ron, thanks for the suggestion of adding /xmlrpc.php to DropRequestList - this actually led to me uncovering the problem. Adding /xmlrpc.php to Drop RequestList does also stop our site falling over, but as you say it is masking the underlying problem.
___________________________________________________________ Yahoo! Photos ? NEW, now offering a quality print service from just 8p a photo http://uk.photos.yahoo.com
_______________________________________________ interchange-users mailing list suppressed http://www.icdevgroup.org/mailman/listinfo/interchange-users
Mail converted by mhonarc 2.6.15
This archive provided courtesy of JSW4.NET, Internet Hosting Services for Small Business.