Feeds

BlackICE slips up over serious security risk

Modified ping flood attack

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

Security tools vendor ISS is warning of a potential denial of service risk to its range of desktop firewall/intrusion protection systems.

Crackers might be able to crash or disrupt affected versions of its BlackICE Defender and BlackICE Agent desktop products, and affected versions of RealSecure Server Sensor using a modified ping flood attack, it has been discovered.

The vulnerability could allow attackers to execute arbitrary code (which could be a virus or Trojan horse backdoor) on targeted computers, ISS warns.

A flaw in routines used for capturing transmitted packets is behind the problem.

Most corporate firewalls already block ICMP-based attacks (like ping flood) from external IP addresses, so the risk isn't that serious for enterprise users. That said, the vulnerability stills counts as an embarrassing oversight by ISS, especially after it made considerable play in highlighting a lesser DoS risk affecting its open source competitor, Snort, less than a fortnight ago.

ISS has developed and is testing fixes for the vulnerability. Details of what patches are available now, and details of suggested workarounds (which involve blocking ICMP packets) can be found here. ®

Related stories:
Stealth encoding bypasses IDS protection
Denial of service warning for network security tool
IDS users swamped with false alerts
Network ICE CTO responds to further BlackICE criticisms
ISS to acquire Network ICE
Different approach to intrusion detection touted
Carnivore substitute keeps Feds honest
Network Ice posts do-it-yourself Carnivore kit

Remote control for virtualized desktops

More from The Register

next story
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Musicians sue UK.gov over 'zero pay' copyright fix
Everyone else in Europe compensates us - why can't you?
Megaupload overlord Kim Dotcom: The US HAS RADICALISED ME!
Now my lawyers have bailed 'cos I'm 'OFFICIALLY' BROKE
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
BT said to have pulled patent-infringing boxes from DSL network
Take your license demand and stick it in your ASSIA
Right to be forgotten should apply to Google.com too: EU
And hey - no need to tell the website you've de-listed. That'll make it easier ...
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.