Do I need to recompile and/or re-link my applications that use the SmartSockets C client libraries?
Customer applications using the C client libraries are open to two attack vectors. Use of the standard SmartSockets messaging API exposes client applications to an attack via data injection. Use of the TipcConnAccept API entry point exposes applications to a direct TCP attack. A data injection attack requires that an attacker be able to insert data in the TCP communication channel between the SmartSockets Server and a client application, altering the client-server wire protocol. Customers should evaluate their network control and access policies to determine the exposure to a data injection attack. Customer applications using the TipcConnAccept API entry point (which allows a SmartSockets client to accept connections from another application, much as the RTserver does) are directly exposed to rogue client connections exploiting the client-to-client TCP connection. The exposure to this defect can be mitigated with a firewall that limits the peer hosts allowed to initiate a connection to
Related Questions
- Do I need to recompile and/or re-link my applications that use the Rendezvous C, Java or .NET client libraries?
- Do I need to recompile and/or re-link my applications that use the SmartSockets C client libraries?
- Do I need to recompile and/or re-link my applications that use the Rendezvous DataSecurity?
