Re: SSL Vulnerabilities?

["Ge' Weijers" <ge () progressive-systems com>]

Hi,

The proxy protects you against exploits that target bugs in the server
IP stack, I can't see any other use for it. If you go the packet
filtering (sorry, MLSI) route some exploits may get through. Other
than that there should not be much of a difference between the two
setups. If you trust the server IP stack you can replace FW-1 with a
simple router filter set:

TCP destination port 443 inbound
TCP source port 443 outbound (established only)
some ICMP types to keep Path MTU working.

That should save your company some money, but it may be politically
unwise to propose that :-/

Ge'

-- 
-
Ge' Weijers                                Voice: (614)326 4600
Progressive Systems, Inc.                    FAX: (614)326 4601
2000 West Henderson Rd. Suite 400, Columbus OH 43220