Re: [Full-Disclosure] 3 new MS patches next week... but none fix

[Tim <tim-security@sentinelchicken.org>]

> Most likely what the guy is selling (or trying to sell) is some sort of
> IDS/network system that grabs the problem packets before they get to the
> server's application layer to do damage. Companies like eEye have been doing
> this for a long time - have a predefined "these packets are within our
> tolerances" baseline and then anything that is outside of it gets squished.
> It is actually a good idea (I think) for any machine publicly exposed. You
> define the traffic you are willing to take including request lengths, etc
> for various ports/protocols and anything outside of that gets dropped and an
> error is generated. Maybe it is a new way to access a new app on the box,
> maybe it is a new attack style. Either way if say that HTTP request is
> composed of more than say x bytes, the http daemon never sees it. 


Based on the link just posted, this is probably along the lines of what
it is they were trying to sell.  I could be wrong, but it still seemed
like this vendor is getting information before the rest of the world.

I think it is a totally lame approach.  The patch distribution problem
has been pretty much solved by other vendors.  We would all sleep better
at night if M$ would just get a clue.  Oh well.

tim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html