DoS attack

Question

Hi!
Our webservice is based on WebLogic stateless session bean sample. As it was
done in the sample, I used to create the connection object like this:
theMyConnect = new MyConnectService(theURI).getMyConnectServicePort();
I create new object for each client call, and I thought that this was OK,
because WebLogic documentation does not say anything about freeing the
connection. In fact, it says that web service is just a wrapper for normal
connection through servlet. Thus, for each call (if they can be
distinguished from each other, of course), server creates new HttpSession
object. Brief analysis of decompiled WebLogic code shows that WebLogic took
some measures to maintain session and to prevent number of connections.
Anyway, what happens in reality if
ConnectService(theURI).getMyConnectServicePort() is called for each web
service call, is that during load test after about 1500 calls WebLogic hangs
with OutOfMemoryException. (-mx200). Application can be restored only by
restarting the server. If this call is done only once at the start of the
application, OutOfMemory does not happen.
I think that Bea might give some recommendations and precautions for
developers about this matter. Also, it would be nice if WebLogic web service
helper classes were revised to ensure that no OutOfMemory would occur. The
reason for this is that B2B calls are not as C2B calls, they may happen in
massive flow, and all data should be maintained properly.
We are still using WL7.0.0.0 GA. Upgrade is not desired right now, but may
be considered if this bug is fixed in 7.0.0.1.
Michael J.

Answer 1

First you have to be aware that the cvpn is kind of a legacy technology and some of the vulnerabilites that IKE has presented in the past might be present on this box, the important part to cover here is to make sure that your box does not have a weak IKE policy enabled which will include DES, MD5 and DH1, if this is an IKE policy that you have enabled then make sure it is disabled since it is easily breakable.
Unfortunately there is no feature on the CVPN that will rate or prevent unknown ike requests but disabling these combinations might help.
As for the study materials you can go ahead and read the users guide for this box.