Press "Enter" to skip to content

nuxx.net Posts

MS12-006 and HTTP 408 Errors

Published February 20, 2012

I recently worked on an issue where a new Microsoft patch for a security bulletin, MS12-006, was correlated to a web-based application occasionally returning errors. Specifically, while using a web-based version of a reporting package off of a version of Sun (Oracle) Java Web Server the browser would occasionally return a Times New Roman-font “Request Timeout” message when users clicked report-generating links. The folks who support the server working on the issue initially had spent time uninstalling recent patches and found that removing KB2585542 (the patch for MS12-006 on Windows 7 clients) from the client machine would stop the issue from occurring. They then thought it might be a Windows client issue, which is where I got involved.

After some investigation it turns out that the problem was actually with the web server not handling split (fragmented) SSL/TLS records properly. The installation of the patch for MS12-006 causes IE to, in some cases, split SSL/TLS records into multiple requests. Since the server couldn’t appropriately handle these requests it thought the client closed the connection before sending a complete request and returned an 408 Request Timeout message.

This was illustrated by the HTTP logs on the server which show incomplete requests being returned 408 messages, similar to what follows. The bold line illustrates a request that correlates with the issue:

IP       | Username | Date                 | Request Header              | Status | Content | Length
---------+----------+----------------------+-----------------------------+--------+---------+--------

10.0.0.2 | -        | 17/Feb/2012:10:03:25 | "P"                         | 408    |         | 148

10.0.0.2 | -        | 17/Feb/2012:10:01:13 | "POST /TestApplet HTTP/1.1" | 200    |         | 13056

After the installation of the patch for MS12-006 there is a setting which allows this new feature to specifically be used only when called for (“optin mode”, the default), all the time (“enabled for all”), or never (“disabled for all”). Setting the option to “disabled for all” kept the issue from being reproduced, and when set to “enabled for all” it always occurred. (See the Registry Information section of 2643584 for more information on these options and how to set them.) By this I showed that it was this SSL/TLS feature causing the issue communicating with the server. Since this appeared to be an issue only with this particular server the team supporting it is now looking into potential solutions on that side.

While it may be tempting to simply disable this feature on clients, this would handicap one of the security enhancements brought along with the MS12-006 patch. Since this issue isn’t likely to be widespread (else lots of HTTPS sessions would be failing) I believe that the servers should be fixed to be compatible with the client’s standard behavior. Specifically, I believe the issue to actually be with the server not having an RFC2246-compliant TLS implementation and thus it should be fixed.

Hopefully this information will be useful to others who run into such an issue. It’s a bit opaque at first, since it looks to the users like the server is having a problem, but to server like the client is occasionally failing to send proper HTTP requests. Trying to troubleshoot this with Fiddler didn’t help either, because the HTTPS proxying would recreate the request, apparently no longer splitting the SSL/TLS record, which kept the error from appearing.

Here’s a few links which are helpful in understanding this issue, in order of usefulness:

· MS12-006: Vulnerability in SSL/TLS could allow information disclosure: January 10, 2012
· SSL/TLS Record Fragmentation Support – Microsoft blog article describing the issue in reverse, from a few years ago when SChannel didn’t support SSL/TLS Record Fragmentation.
· Microsoft Security Bulletin MS12-006 – Important, Vulnerability in SSL/TLS Could Allow Information Disclosure (2643584)
· HTTP Status Code 408 Documentation
· RFC2246 – See section 6.2.1.

1 Comment

Dirty Ears Beget Dirty Earplugs

Published February 18, 2012

Last night I put in some ear plugs, but because I hadn’t cleaned out my ears first all of the wax in my ears seemed to stick to the plugs, as seen above. (Click here to embiggen.) While I now have to toss out these earplugs, it does show that they do a pretty good job serving as an impromptu — though not immediate — ear cleaning solution.

1 Comment

A February For Riding

Published February 18, 2012

This February’s bizarre weather has made for some really nice riding. After a hectic (but good) day working I was able to get out a little early and go for a ride. Trails are still too squishy to ride, but almost all of the pavement was dry, the sun was out, and the air was warm enough that I could wear knickers, toe covers, a base layer, and a light wind jacket.

During this ride I explored a few neighborhoods that I’d yet to pass through, finding a new (to me) connector to the MOT near 24 Mile and a route through an undeveloped neighborhood, up a small rock retaining wall, and into another neighborhood that I frequently pass through. While I didn’t venture into it (because of the aforementioned soft ground and my relatively skinny tires) I also came across a sane entrance to this path-filled yet apparently abandoned area which might be a nice place to take a break and eat. More and more of this area is starting to come together mentally, and I’m getting even more ideas for long path/residential/dirt road rides.

The full route / GPS data for the ride can be seen here if you’re interested.

Leave a Comment

LP Gas Tank Weights

Published February 18, 2012

My LP gas tank, when essentially† empty, weighs 17.82 pounds. When freshly filled by Metropolitan Tool Rental in Shelby Township it weighs 36.32 pounds. The TW (tare weight) stamp on the chime indicates that the empty tank should weigh 17 pounds.

I’m not sure if I’ll go to Metropolitan for another tank fill, as they seem to charge a fixed price for tank filling regardless of amount needed. I was getting one tank filled and another (which was about half empty) topped off, and I was initially told that there was a flat rate for filling any tanks. Asking them if it’d really be full price to have one tank partially filled they cut that price in half. Next time I’ll try and find a shop that simply charges by the quantity of fuel sold plus a base service charge or something.

† Essentially empty is defined as when the tank is empty enough that, while operating a turkey fryer burner for brewing beer, it would not produce a normal flame and thick frost was developing on the very bottom of the tank. Upon swirling the tank to warm the liquid the flame would return to normal size, but within a few minutes it would settle back town to a trickle. I’m presuming that the gas level was low enough that any evaporation (read: liquid turning to burnable vapor) was sufficiently chilling the remaining liquid so that it wouldn’t readily evaporate.

Leave a Comment

Burroughs Mainframe Cards

Published February 17, 2012

Years ago I got the chance to help empty out a friend’s neighbor’s basement after they passed away. This basement was stuffed with old computers and electronics, and I acquired a number of interesting items from there, many of which are now displayed around the house. (Core memory, old test equipment, notebooks, etc.)

The photos from this excursion can be found here, if you’re interested.

One of the items I’d acquired was a milk crate full of old cards from a Burroughs mainframe. Each is a bunch of discrete components built into what’s essentially a logical unit, designed to perform some function. These days a small integrated circuit would be used to perform the same (or multiple) functions.

I’ve given many of these items away, as in my excitement I ended up with many more items than needed. Everything from large boxes of valves to old, uncalibrated oscilloscopes have found homes with friends who had a better use for them than I did. A little while back I was contacted by a guy named William Donzelli who was interested in the history of the Burroughs mainframe and the cards from it. I didn’t know much about it and couldn’t answer many questions, so a couple days back I sent off this box containing the cards to him. Hopefully he’ll find them enlightening.

1 Comment

Crucial m4 SSD for Data Processing

Published February 14, 2012

I’ve been processing some relatively large sets of data at work lately, and I’m running into disk IO issues after kicking off some of the data processing tasks. As an easy way to alleviate this I picked up a 64GB Crucial m4 SSD and stuffed it into my laptop’s optical drive bay via a $20 Nimitz-branded SATA hard drive adapter acquired from eBay. The drive itself was $99.99 from Micro Center, and since I purchased it myself once I’m done working with it I’ll be able to repurpose it in a personal machine of some sort.

While not a panacea nor excuse for my poor habits of bolting together VBScript and GNU command line utilities, it has helped quite a bit. One typical script (immediately post-reboot, with an empty disk cache) takes ~120.234 seconds to run a task from the hard drive and ~28.400 seconds from the SSD. I’ve seen similar speed improvements across the board, and this really helps when I’m prototyping things and wanting feedback as quickly as possible.

Leave a Comment

There’s a Rock in my Hops!

Published February 12, 2012

After some fun bike riding I got to brewing another batch of beer; a slight variant on a blonde ale referred to by Cap N Cork as Vegas Gold. This was to have 2 oz of Sterling Leaf Hops in it (these are from LD Carlson), but while measuring them out into two mugs there was a bang of something hard falling into one of the containers.

Reaching into the hops I found this rock, which per my kitchen scale has a mass of ~10g. I thought that one of this bag of hops seemed a bit small, but I figured it was just a little more compact than usual. Since it constituted a bit more than one third of a bag the finishing and aroma additions were a bit short, but I’m sure the beer will be fine. And now I have a hop-encrusted rock!

(Thankfully this was in the bag that I’d been measuring out and not the one that got dumped right into the kettle. While I don’t think the rock is particularly dirty I’m glad it didn’t get boiled in case something odd might have come off or out of it.)

UPDATE: I’d emailed this post to LD Carlson, and a very friendly person there contacted me and ended up sending me some replacement hops which I used in my next batch of beer. Interestingly, they no longer stocked Sterling Leaf Hops, so the ones that I purchased must have been pretty old. Hopefully it won’t mess with the flavor of the beer. Maybe I should stick to pelletized stuff for now on…

Leave a Comment

Fat Bikes at River Bends

Published February 12, 2012

This afternoon, in lieu of a lengthy dirt road ride†, a few folks and I met up at River Bends to ride some snow covered trails. This was quite a bit of fun and I managed to get in just under an hour and a half of moving time. Some of the trails were a bit iffy on the current tires on the Mukluk (particularly the Endomorph on the rear), but it was still a good time. I may want something a bit knobbier next year, but for now I’ll stick with what I have.

The photo above shows James (with the mohawk, who didn’t originally plan to meet up with us but just happened along as we were in the parking lot), Bob, and Nick as they are queued up to cross a stream in River Bends’ Seasonal Loops by walking on a very makeshift bridge. I’d already passed, as did Carlos who was standing a few feet behind me. This ended up being a pretty nice ride, and hopefully I’ll be able to get out for a few more rides this winter. Maybe tomorrow… We’ll see…

† Mostly due to the 30MPH+ wind gusts and negative-digit-Fahrenheit wind chill.

1 Comment

Found: Danielle’s Pink Mitten

Published February 9, 2012

Back at the end of January Danielle was hiking at Stony Creek, but lost her mitten while on the Roller Coaster. Despite a post to the MMBA Forum’s Lost and Found section it hadn’t been returned.

Then, last night while out riding Stony Creek in the dark something pink and sparkly caught my eye as I passed a tree. It was Danielle’s pink mitten! Someone had picked it up and set it in the crook of a tree along the side of the trail.

Now Danielle has a matching pair of mittens again. Yay!

UPDATE: Turns out that she’d declared the situation lost and thrown out the other mitten this past weekend. Oh well.

Leave a Comment

Nice Trainer Setup

Published February 8, 2012

I’m pretty happy with the current trainer setup in the basement. It is located in front of the TV but behind the futon so I can watch a movie while riding and Danielle can use the futon (to watch the movie or play games) without us needing to move anything around. My netbook is on a keyboard stand in front of the bike so I can use TrainerRoad instead of a typical bike computer, and the I-beam spanning the basement is directly overhead and serves as a convenient shelf. The kegerator of homebrew is for after.

1 Comment