SYMPTOMS
The Internet Information Server FTP service includes a passive mode
command (PASV) to request that the server wait for a connection instead of
initiating one after receiving a transfer command. Certain situations
using multiple passive connections may result in errors, problems with
system performance as well as denial of service situations for both the
Web and FTP services.
Server Administrators will see the following error in the System Event
Log:
FTP Server could not create a client worker thread for user at host
<IPAddress>. The connection to this user is terminated. The data is
the error.
Clients accessing either the WEB or FTP services may see a message similar
to one of the following:
- Connection closed by remote host
- The FTP session was terminated
RESOLUTION
To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in the
Microsoft Knowledge Base:
152734 How to Obtain the Latest Windows NT 4.0 Service Pack
NOTE: The fix for a bug in the W3 and FTP Performance Monitor ALSO fixes
the problem described in this article. If you plan to use the Performance
Monitor, please see the following article in the Microsoft Knowledge Base:
185349
: Problems Remotely Accessing W3 or FTP Perfmon Counters
To resolve this problem, download and install one of the following fixes
or wait for the next Windows NT service pack.
Intel Platforms
IIS 4.0:
IIS 3.0 and IIS 2.0:
Alpha Platforms
IIS 4.0:
IIS 3.0 and IIS 2.0:
NOTE: Each of the above URLs above is one path; it has been wrapped for
readability.
NOTE: You might also consider running the WEB and FTP services on
separate servers to further decrease the possibility of attacks against
multiple services.
For additional information, please see the following article in the
Microsoft Knowledge Base:
189271
: Minimal services to run on a secure IIS Server
NOTE: This fix limits the denial of service attack and lessens it's
severity. However, there will still be a limited effect on the operation
of the FTP server. Clients that use PASV mode connections to connect to
the FTP server may be denied service and clients that are uploading
information to the FTP server may be denied service. If this attack
occurs, there will be many event log entries of the type shown below. The
event log entries will give the user name of the attacker and the IP
address that originated the attack. This will enable the attacked
machine's owner to deny the user or originating site access to the FTP
server.
Event Log Entries:
- Passive connect from user %1 at host %2 timed out. If you are seeing a
large number of these events, you may be experiencing a denial of
service attack. See http://www.microsoft.com/security for more
information.
- File received from user %1 at host %2 timed out. If you are seeing a
large number of these events, you may be experiencing a denial of
service attack. See http://www.microsoft.com/security for more
information.