Would exploiting the vulnerability give the attacker complete control over an entire network?
Best practices would help limit the scope of the compromise. Because of their exposed position, web servers – especially public ones – are always special targets for attack, and the network design should reflect this fact. Indeed, one of the network architect’s principal objectives should be to ensure that the network design limits what could be done using a compromised web server. Two practices in particular that should be followed are: * Web servers should be isolated within a DMZ. This not only separates the servers from the Internet, but also separates them from the rest of the network. * If possible, web servers should be configured as stand-alone machines. If it is necessary to make them part of a domain, the domain should only encompass machines that reside on the DMZ. Web servers should never be members of the larger network’s domain. Even if these precautions have been followed, however, it is important not to underestimate the damage that could be done via this vulnerability.
