IIS-5.1 ISAPI dll - "The page cannot be displayed" after XP

iis security : IIS-5.1 ISAPI dll - "The page cannot be displayed" after XP - SP2 install

Phil Borod
9/5/2004 3:34:34 PM

IIS-5.1 ISAPI dll - "The page cannot be displayed" after XP - SP2 install

On my XP-Pro localhost, this worked fine before SP2 install:

Clicking the Submit button on a localhost web page would execute the
clogin.dll.

<form name="CSLogin" method="POST" action="../CGI-WIN/clogin.dll">

Installed SP2, and try the same button and the same localhost web page and
receives:
"The page cannot be displayed"
The page you are looking for is currently unavailable.

I thought I found a very similar issue in
MS KB # 842005 - How to enable the ISAPI component on SQLXML on Windows XP
Service Pack 2.
Since they addressed the tweaking of the SP2 firewall, I disabled it
completely to see if that would work.
No luck.

Remember that the IIS-5.1 web permissions were working before the SP2
install. I didn't write the dll; it is part of a purchased software package
and the vendor is not sure what the problem is either.

Any ideas appreciated.

David Wang [Msft]
9/5/2004 5:08:13 PM

Please turn off the "Show Friendly HTTP Errors" option of IE and post the
actual error response you get.

XPSP2 installs and enables a firewall which blocks all unsolicited incoming
traffic for security purposes. This will block IIS from functioning. The
secure way to re-enable IIS is to leave the firewall running and set up a
port exception for IIS. The following command opens up port 80 on the
firewall to allow IIS to function -- we use this command all the time during
our testing of IIS on XPSP2.

NETSH firewall set portopening mode=ENABLE profile=ALL scope=ALL
protocol=TCP port=80 name="HTTP"

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
IIS-5.1 ISAPI dll - "The page cannot be displayed" after XP - SP2 install

On my XP-Pro localhost, this worked fine before SP2 install:

Clicking the Submit button on a localhost web page would execute the
clogin.dll.

<form name="CSLogin" method="POST" action="../CGI-WIN/clogin.dll">

Installed SP2, and try the same button and the same localhost web page and
receives:
"The page cannot be displayed"
The page you are looking for is currently unavailable.

I thought I found a very similar issue in
MS KB # 842005 - How to enable the ISAPI component on SQLXML on Windows XP
Service Pack 2.
Since they addressed the tweaking of the SP2 firewall, I disabled it
completely to see if that would work.
No luck.

Remember that the IIS-5.1 web permissions were working before the SP2
install. I didn't write the dll; it is part of a purchased software package
and the vendor is not sure what the problem is either.

Any ideas appreciated.

Phil Borod
9/6/2004 5:50:07 AM

David,
As you suggested, turned off the "Show Friendly HTTP Errors" switch in
IE, and received an OK after running the suggested "NETSH ..." command.
Still same error. Remember that I am able to access the
http://localhost/catalog.htm that has the submit button on it, so the IIS
server is up & running http:. But when it tries to access the
<form name="CSLogin" method="POST" action="../cgi-win/clogin.dll">, the
correct address appears in the address bar:
http://localhost/carib/cgi-win/clogin.dll
on the localhost, but still getting the same error. Here is the full text
error message page:
----- (Start of error message page)-----

The page cannot be displayed
The page you are looking for is currently unavailable. The Web site might be
experiencing technical difficulties, or you may need to adjust your browser
settings.

Please try the following:

Click the Refresh button, or try again later.

If you typed the page address in the Address bar, make sure that it is
spelled correctly.

To check your connection settings, click the Tools menu, and then click
Internet Options. On the Connections tab, click Settings. The settings
should match those provided by your local area network (LAN) administrator
or Internet service provider (ISP).
See if your Internet connection settings are being detected. You can set
Microsoft Windows to examine your network and automatically discover network
connection settings (if your network administrator has enabled this
setting).
Click the Tools menu, and then click Internet Options.
On the Connections tab, click LAN Settings.
Select Automatically detect settings, and then click OK.
Some sites require 128-bit connection security. Click the Help menu and then
click About Internet Explorer to determine what strength security you have
installed.
If you are trying to reach a secure site, make sure your Security settings
can support it. Click the Tools menu, and then click Internet Options. On
the Advanced tab, scroll to the Security section and check settings for SSL
2.0, SSL 3.0, TLS 1.0, PCT 1.0.
Click the Back button to try another link.

Cannot find server or DNS Error
Internet Explorer

----- (End of error message page)-----------
-----------------------
[quoted text, click to view]

Phil Borod
9/6/2004 6:35:14 AM

David,
Here are some possible variables that may help:
I notice the XP task manager shows several dllhost.exe's running.
Normally, the user for the dllhost.exe is 'System'.
However, I've seen two other dllhost.exe entries with
user "IUSR_DELL81" (my Windows user is DELL81),
and another dllhost.exe with user IWAM_DELL81.
Also, I am not using Server Extensions. The ISAPI.dll is a filter, not
extension.
Thanks for your input.
Phil
------------

[quoted text, click to view]

Phil Borod
9/6/2004 7:55:31 AM

David,
The deeper I look, the more interesting & perplexing. Here's some more
info :
System event log shows W3SVC error with user "N/A", yet
the http: web server logs look normal:
#Software: Microsoft Internet Information Services 5.1
#Version: 1.0
#Date: 2004-09-06 09:11:26
#Fields: time c-ip cs-method cs-uri-stem sc-status
09:11:26 127.0.0.1 GET /carib/htdocs/Catalog.htm 200
09:11:26 127.0.0.1 GET /carib/htdocs/CSlogo.gif 200
09:11:26 127.0.0.1 GET /carib/htdocs/CSlogo.jpg 200
09:11:26 127.0.0.1 GET /carib/htdocs/qs_chlk.jpg 200
09:11:36 127.0.0.1 POST /carib/CGI-WIN/clogin.dll 200
09:11:37 127.0.0.1 POST /carib/CGI-WIN/clogin.dll 200
09:11:39 127.0.0.1 POST /carib/CGI-WIN/clogin.dll 200

Thanks in advance for your input.
Phil

[quoted text, click to view]

David Wang [Msft]
9/6/2004 12:43:25 PM

I think you need to contact the support for your purchased software.

When you clicked submit:
1. the browser's URL bar showed the URL
http://localhost/carib/cgi-win/clogin.dll -- showing the browser parsed the
HTML and made the request
2. the Web server log shows requests for /carib/cgi-win/clogin.dll --
showing IIS successfully received the request, passed execution into the
ISAPI Extension DLL itself, and received a response from it that was sent
back to the client. The content of the response depends completely on the
ISAPI
3. The response shown in the browser indicate that either something between
IIS and the browser closed the connection, or the ISAPI DLL itself closed
the connection.

So, I have to ask you:
1. what else is running on this machine, and whether you have any ISAPI
Filters loaded and configured properly
2. how can you verify that your ISAPI Extension is correctly configured?

My gut feeling (unsubstantiated) is that your ISAPI Extension relies on some
COM component with greater privileges than it now has with XPSP2's security
tightening, and on COM component failure, the ISAPI Extension aborted the
connection. You must contact your software's support and verify that it
should function on XPSP2, and if so, what its configuration should be.

FYI: Technical point -- the ISAPI DLL clogin.dll is at least an ISAPI
Extension.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
David,
The deeper I look, the more interesting & perplexing. Here's some more
info :
System event log shows W3SVC error with user "N/A", yet
the http: web server logs look normal:
#Software: Microsoft Internet Information Services 5.1
#Version: 1.0
#Date: 2004-09-06 09:11:26
#Fields: time c-ip cs-method cs-uri-stem sc-status
09:11:26 127.0.0.1 GET /carib/htdocs/Catalog.htm 200
09:11:26 127.0.0.1 GET /carib/htdocs/CSlogo.gif 200
09:11:26 127.0.0.1 GET /carib/htdocs/CSlogo.jpg 200
09:11:26 127.0.0.1 GET /carib/htdocs/qs_chlk.jpg 200
09:11:36 127.0.0.1 POST /carib/CGI-WIN/clogin.dll 200
09:11:37 127.0.0.1 POST /carib/CGI-WIN/clogin.dll 200
09:11:39 127.0.0.1 POST /carib/CGI-WIN/clogin.dll 200

Thanks in advance for your input.
Phil

[quoted text, click to view]

David Wang [Msft]
9/6/2004 3:41:04 PM

I think you should contact support for your purchased software.

Random ISAPI configuration is unlikely to help. You really need expertise
with what the software requires.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
David,
Your gut feeling coincides with mine. This dll was written before the
concept of ISAPI Extensions. It functioned as an ISAPI filter. I have not
dealt with or configured ISAPI extensions at all. Should I give that a try?
Phil

[quoted text, click to view]

Phil Borod
9/6/2004 4:37:53 PM

David,
Your gut feeling coincides with mine. This dll was written before the
concept of ISAPI Extensions. It functioned as an ISAPI filter. I have not
dealt with or configured ISAPI extensions at all. Should I give that a try?
Phil

[quoted text, click to view]

Phil Borod
9/6/2004 7:08:43 PM

David,
Good advice. Am going that way. Thanks much.
Phil
[quoted text, click to view]

Phil Borod
9/8/2004 11:19:36 AM

David,
Received a response from the vendor. The DLL we are using has been
renamed, but it is actually IS2WCGI.DLL. The vendor believes that this is a
Microsoft written DLL. There is a writeup of it on the Microsoft Developer's
Network at http://www.microsoft.com/mind/0396/ISAPI/ISAPI.asp about 2/3 of
the way down the page.
Hope this helps.
Phil Borod - TICI

[quoted text, click to view]

David Wang [Msft]
9/8/2004 2:33:54 PM

The vendor is still responsible for supporting their product.

I see no indication that IS2WCGI.DLL is a Microsoft supported product -- it
looks like sample code to me, source code and all. Thus, this is NOT like
redistributing msvcrt.dll, which is supported code. Thus, the vendor is
solely responsible for it, especially since they have the source code to the
sample.

If this ISAPI merely invokes another CGI EXE from the Vendor to do the work,
then clearly the vendor will have to investigate that interaction. My gut
feeling remains -- there is probably some Security-related issue in here,
and the Vendor will have to figure out what there support policy is, what
the actual issue is, and what they have to do to fix it.

Bottom line -- All you need to ask the vendor is:
"Do you support product X on XPSP2".

If they do not support XPSP2, then your choices are to either move to
another product, or ask when they will support it.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
David,
Received a response from the vendor. The DLL we are using has been
renamed, but it is actually IS2WCGI.DLL. The vendor believes that this is a
Microsoft written DLL. There is a writeup of it on the Microsoft Developer's
Network at http://www.microsoft.com/mind/0396/ISAPI/ISAPI.asp about 2/3 of
the way down the page.
Hope this helps.
Phil Borod - TICI

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis security

View Other Months
June 2003
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
May 2008
June 2008

home · blog · groups

Questions? Comments? Contact the dn