Recently sample code was posted publicly that exploits a denial of service vulnerability in the Apache HTTP Server. This particular vulnerability is receiving considerable industry attention given the popularity of Apache httpd and amid reports that exploitation has been seen in the wild. This vulnerability has been assigned CVE ID CVE-2011-3192 and currently scores a 7.8/6.3 using CVSS.
By combining inefficiencies inside the web server software with a protocol design peculiarity, an attacker could consume substantial server CPU and memory by issuing requests that contain many overlapping Range or Request-Range values. Successful exploitation would consume server resources to the point of starving those needed to field legitimate requests from other users.
I recently had the good fortune of having dinner with the chief security officers (CSOs) from five major healthcare providers. The CSOs weren’t shy about what was plaguing them.
The biggest headache? Managing consumer devices. Doctors love their iPads and want to use them for work. (It must be the form factor-a next-gen version of the metal-covered chart ubiquitous on medical drama TV shows.) The real life numbers tell the same story. According to Manhattan Research, a healthcare market research firm, just one year after the iPad hit the market, 30 percent of U.S. physicians had adopted the device and an additional 28 percent plan to purchase an iPad within the next six months.
Today, more than ever, an increasing number of Cisco employees and its extended workforce are connecting to Cisco’s corporate network using their devices of choice. The speed by which these devices are joining the network is not only staggering, but also significantly impacting the IT and security organizations’ approach to protecting the information assets and the services we deliver. The Apple iPad, as a prime example, actually appeared on the Cisco network the day before the technology was released to the general public, showing that IT and security professionals need to be aware, prepared, and nimble enough to keep pace with the speed of today’s innovation and change.
Most large organizations and enterprises at least try to take security pretty seriously. This means that the front door is not only usually locked, it is fortified and reinforced. This makes it hard for the bad guys to get in. So, do they give up? Of course not! What they do instead is look around back and start rattling the door knobs on the shed and cellar and the servants entrance and try to work their way in that way.
High value targets are usually locked down and secured pretty well, but this is not always the case for lower value targets. Once compromised, these lower value targets can provide a useful platform from which to attack other systems. For example, while traffic from the internet to internal hosts may be tightly limited, in many cases traffic between machines in the DMZ may not be as well regulated. Thus if you can own one machine in the DMZ, it can be easier to compromise other systems.
A collaboration of four senior members of the Cisco IPS signature team recently culminated in the public release of a guide on writing custom signatures for Cisco IPS, the #1 IPS platform of the Internet. The idea behind this move is to give our customers an easier way to develop their own signatures, allowing them to more easily discover and block unwanted traffic in their networks. At the same time it helps in understanding existing signatures written by members of the IPS signature team.