Layer Seven Security

Why you should immediately patch the recent DoS Vulnerability in AIX

admin on April 11, 2012

IBM released an advisory in February for a Denial of Service (DoS) vulnerability in AIX versions 5.3, 6.1, and 7.1. The warning seems to have flown under the radar since so far, many companies running the effected AIX OS platforms for their SAP environments have yet to deploy the patch. The vulnerability relates to a flaw in ICMP packet handling. An ICMP echo reply with ID=1 can lead to a DoS. ICMP is part of the Internet Protocol Suite and can be used to relay query messages. Echo reply is a ping utility that can be executed remotely with no authentication and very little complexity. The vulnerability has a CVSS base score of 7.8 and exploitability sub-score of 10 which means it is rated as extremely dangerous. The relevant security update can be downloaded directly from IBM through ftp://aix.software.ibm.com/aix/efixes/security/icmp_fix.tar. Technical information is available at http://www-01.ibm.com/support/docview.wss?uid=isg1IV08255.

 

Microsoft Hack Exposed Credit Card Details

admin on February 27, 2012

Earlier today, Microsoft issued a statement that declared that the financial information belonging to customers of its online store in India may have been compromised by the recent attack perpetrated by a Chinese group called the “Evil Shadow Team.”

It is widely believed that this information was stored in clear text in databases raided by the group. The Evil Shadow Team may also have breached the supposedly secure gateway handling the payment process. In an original statement issued shortly after the attack, Microsoft had claimed the group had only compromised login IDs, passwords and possibly shipping addresses. However, after further investigation, it appears that the damage was far worse. Two weeks after the attack, the online store is still down, suggesting there are serious issues with the site.

To learn how to secure SAP systems against similar attacks, read our whitepaper.