|
Brought to you by:
Suppliers of:
|
|
|
| |
Top Layer's Attack Mitigator IPS 5500 is an ASIC-based Network Intrusion Prevention System (NIPS), with blocking and control capabilities against certain types of cyber attacks. The product's datasheet states that 'Top Layer's second-generation ASIC technology and patented algorithms integrate proven stateful analysis techniques with its new 'TopInspect' deep packet inspection technology and industry-leading DoS attack protection to provide comprehensive protection from Internet-based and internal threats'.
Under certain specific circumstances the Top Layer IPS 5500 series CPU usage could reach 100% utilization, where it would not be able to process further network traffic, and any site protected by the device would become inaccessible. |
| |
Credit:
The information has been provided by Mazin Faour, Louis Garman.
|
| |
Vulnerable Systems:
* Top Layer Attack Mitigator IPS 5500 running software version 3.11.008
Immune Systems:
* Top Layer Attack Mitigator IPS 5500 running software version 3.11.014
The system under test comprised a web server farm accessible via a load balancer and protected by an IPS 5500 device. IRM discovered that upon simulating more than 2000 concurrent HTTP requests to the server farm, the IPS 5500 device reached a state where it was utilizing all its CPU power and therefore was unable to process standard HTTP traffic.
Vendor Response:
Top Layer was notified of this issue on July 22, 2004 by IRM.
A bug exists in Attack Mitigator IPS 5500 software versions earlier than V3.11.014 that could cause the IPS 5500 device to incorrectly enter an overload protection mode and negatively impact network traffic. In extreme cases, this can cause a denial of service condition.
The effect of this bug appears only when the IPS 5500 unit is configured in a topology where a high-volume of network packets traverses the IPS unit twice due to a "one-armed" routing configuration.
The presence of this error condition will exhibit the following when viewing the IPS5500 Immediate Security Report: Current System Processor Utilization = 100% and the value for System CPU Overload Protection is non-zero.
Vendor & Patch Information:
Top Layer were contacted during the testing and immediately started investigating the issue. Top Layer then updated the IPS code (to version 3.11.014) that resolved the issue during the timescales of the security engagement.
The latest IPS 5500 software is available from Top Layer at:
http://www.toplayer.com/content/support/tech_assist/index.jsp
Workarounds:
Top Layer explained that a workaround would be to avoid deploying an IPS 5500 in "one-armed" router configurations.
|
|
|
|
|
