Proxies
HTTP Proxy is often implemented to address security, content filtering, or logging/audit requirements.
When an HTTP proxy is implemented in the network, devices that need to reach external sources typically require manual configuration. This process may result in a lot of overhead in large networks. Automatic proxy discovery is another option but it comes with additional challenges.
The HTTP Force Proxy feature on MR Access Points allows customers to leverage the HTTP proxy on their network without making any changes to the client devices. Since most networks do not leverage an HTTP proxy, this feature is hidden and disabled by default in the dashboard. The proxy configuration options may be enabled on any Meraki MR Dashboard network by the Meraki Support team.
Lockd
A vulnerability has been discovered in the Linux Kernel that could allow for DoS conditions over any open TCP port (CVE-2018-5390). The Linux Kernel version 4.9 is vulnerable, but due to distributions having backported some of the networking code from version 4.9, the scope of the vulnerability is much larger. The exploitation of this vulnerability is asymmetric, requiring a limited number of requests from the attack source. This vulnerability is exploited through the use of specially crafted packets in a TCP session. When triggered, these packets make expensive calls to the CPU that can quickly exhaust available resources. The vulnerable functions, tcp_collapse_ofo_queue() and tcp_prune_ofo_queue(), are used to deal with reassembling TCP segments. This attack requires a continuous two-way TCP connection to an open port, and these attacks cannot be performed using spoofed IP addresses. Successful exploitation of this vulnerability could lead to prolonged periods of downtime and loss of functionality. In order to protect the systems, Apply appropriate updates provided by your Linux Distribution Vendor to vulnerable systems, immediately after appropriate testing, Monitor intrusion detection systems for any signs of anomalous activity and Unless required, limit external network access to affected products are recommended
0 Comments