RazorTongue
Joined: 23 Apr 2007 Posts: 26
|
Posted: Thu Nov 15, 2007 4:47 pm Post subject: Auxsvc.cfg and IPMatch/RawData |
|
|
Aux-connection's are often used to handle critical/real-time mechanisms. From the other side, without proper authentication, it can bring many security flaws(here, I have to mention unpacking errors causing allocation of GBytes of memory - fixed in RC5).
I suggest adding two fields into auxsvc.cfg(per service):
-IPMatch
-RawData
For critical data sent via aux connection, we could use 'IPMatch 127.0.0.1' (ie. if we use aux to create accounts via php script), so nothing bad will happen.
I've also noticed that sending great amounts of packed aux data(strings/arrays) via aux connection still degrades performance(we can perform flood attack without actually sending much data ie. 's100:', 's100:', 's100:') - that could be moderated with RawData field(setting RawData to 1, would disable receiving and sending packed data). |
|