Full Disclosure mailing list archives
Re: 3 new MS patches next week... but none fix
From: Tim <tim-security () sentinelchicken org>
Date: Sat, 10 Jan 2004 08:31:34 -0800
Most likely what the guy is selling (or trying to sell) is some sort of IDS/network system that grabs the problem packets before they get to the server's application layer to do damage. Companies like eEye have been doing this for a long time - have a predefined "these packets are within our tolerances" baseline and then anything that is outside of it gets squished. It is actually a good idea (I think) for any machine publicly exposed. You define the traffic you are willing to take including request lengths, etc for various ports/protocols and anything outside of that gets dropped and an error is generated. Maybe it is a new way to access a new app on the box, maybe it is a new attack style. Either way if say that HTTP request is composed of more than say x bytes, the http daemon never sees it.
Based on the link just posted, this is probably along the lines of what it is they were trying to sell. I could be wrong, but it still seemed like this vendor is getting information before the rest of the world. I think it is a totally lame approach. The patch distribution problem has been pretty much solved by other vendors. We would all sleep better at night if M$ would just get a clue. Oh well. tim _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: 3 new MS patches next week... but none fix Randal, Phil (Jan 09)
- Re: 3 new MS patches next week... but none fix Exibar (Jan 09)
- Re: 3 new MS patches next week... but none fix Tim (Jan 09)
- Re: 3 new MS patches next week... but none fix madsaxon (Jan 09)
- RE: 3 new MS patches next week... but none fix Joe (Jan 10)
- Re: 3 new MS patches next week... but none fix Tim (Jan 10)
- RE: [inbox] Re: 3 new MS patches next week... but none fix Exibar (Jan 10)
- Re: [inbox] Re: 3 new MS patches next week... but none fix Tim (Jan 10)
- Re: [inbox] Re: 3 new MS patches next week... but none fix Jan Lühr (Jan 10)
- The Israeli Post Office break-in ge (Jan 11)
- Re: [inbox] Re: 3 new MS patches next week... but none fix lonely wolf (Jan 10)
- Re: [inbox] Re: 3 new MS patches next week... but none fix Ron DuFresne (Jan 12)
- Re: [inbox] Re: 3 new MS patches next week... but none fix William Warren (Jan 11)