asyncore DoS vulnerability

billie gnewsg at gmail.com
Fri Feb 2 10:32:14 EST 2007


> This is not a CRASH, It looks an exception with a "Traceback", this is
> the normal way python report problems, nothing wrong with that.
> You can handle it with a try: except:

I think that such a thing should be handled by asyncore itself.

> 512 is probably a fixed limit into XP, win2k3 or win2k server will
> accept more.
> Maybe It's possible to increase this value somewhere in the registry.
> If not this is how microsoft justify the difference between server and
> workstation products :-)

Yeah, maybe...

>> Why does this exception isn't handled inside asyncore.py?
> To do what ? To raise a custom asyncore error ?

asyncore aims to be a framework, right?
I think that when select() limit is reached asyncore should just drop
other connections. That's all.

> You can can probably run over this limit by starting multiple of your
> server process (not thread, process).

Hope you're joking...
Why should I have to run multiple processes / threads to avoid such a
problem?
And what if my system / inteprepter does not support multiple
processes / threads?




More information about the Python-list mailing list