One key feature in this release is the new $ssl_preread_protocol variable, which allows you to distinguish between SSL/TLS and other protocols when forwarding traffic using a TCP (stream) proxy. This is useful if you want to avoid firewall restrictions by (for example) running SSL/TLS and SSH services on the same port.
Choose from preconfigured RuleGroups provided in the AWS Marketplace by industry leading security experts: Alert Logic, Fortinet, Imperva, Trend Micro and TrustWave.
然後隨時更新:
Rules are automatically updated as new threats emerge and offer a wide range of protections, including OWASP Top 10 mitigations, bad-bot defenses, and virtual patching against recent CVE’s.
然後是要收費的:
Each RuleGroup is the product of a Seller’s unique expertise, made available to you at an affordable pay-as-you-go price.
Cisco ASA 5500 Series Adaptive Security Appliances
Cisco ASA 5500-X Series Next-Generation Firewalls
Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
Cisco ASA 1000V Cloud Firewall
Cisco Adaptive Security Virtual Appliance (ASAv)
Cisco Firepower 4100 Series
Cisco Firepower 9300 ASA Security Module
Cisco Firepower Threat Defense Software
Cisco Firewall Services Module (FWSM)*
Cisco Industrial Security Appliance 3000
Cisco PIX Firewalls*
標星號的是目前已經沒有在維護的產品,這次只確認受到影響,但不會更新:
Cisco Firewall Service Modules and Cisco PIX Firewalls have passed the last day of software support milestone as stated in the published End of Life (EoL) documents. Further investigations into these devices will not be performed, and fixed software will not be made available.
這次 Cisco 的安全性問題是 SNMP 的洞造成的:
Administrators are advised to allow only trusted users to have SNMP access and to monitor affected systems using the snmp-server host command.
這個洞被 NSA 用來寫 exploit 植入系統:
This flaw was included inside two NSA exploits, dubbed EPICBANANA as well as JETPLOW, which is an enhanced version of EPICBANANA, but with better persistence capabilities, Cisco's Omar Santos said in a blog post.