Hit After the Fix
Days after fixing two NetScaler flaws, Citrix rushed out a fix for a third one that attackers were already using to crash network gateways.
Key terms
AP Cybersecurity alignment
- 4.1.C.6Adversaries can send malicious data to devices to disrupt them or attempt to take control of them. Devices that have no firewall (or a misconfigured firewall) cannot filter out this malicious data.Learning objective: Explain how adversaries can exploit common device vulnerabilities to cause loss, damage, disruption, or destruction.
- 5.1.B.8A buffer overflow attack feeds more data into memory than was allotted, which can cause a system to crash or to execute code outside the scope of a program’s security policy, effectively allowing the adversary to perform…Learning objective: Explain how application attacks exploit vulnerabilities.
- 5.5.B.2When creating a program that takes user input, programmers should use a function to verify that user input meets their expected criteria and does not include any control characters that could be used to manipulate the system.…Learning objective: Explain how user input sanitization protects applications.
AP Networking alignment
- 4.1.A.5When availability is compromised, systems have unexpected periods of time when they are out of service. A breach of availability can be identified by: • an inability to access systems, networks, or resources • slow or dropped…Learning objective: Identify evidence of compromised confidentiality, integrity, or availability.
- 4.1.B.1Network connectivity supports essential tasks such as communication, data access, and service delivery. When connectivity is unreliable, users or employees may lose access to essential systems, which can lead to delays,…Learning objective: Explain how unreliable connectivity impacts organizations.
- 4.6.B.4Applying and documenting software updates and patches reduces the risk of failure and reduces recovery time if an outage occurs.Learning objective: Identify ways to improve the reliability and availability of networked systems.