CSA & LSASS exploits

[acciai_gf]

We're using CSA in HA server situations to avoid reboots on the endless stream of MS patches.. Issue we have on worm "buffer overruns" attacks on key Windows components (LSASS, RPC, etc) is that CSA stop the attacks (HA servers not infected - a good thing), but LSASS is "killed" (due to the real buffer overrun) and then Windows itself "reboots" the box in 60 secs once LSASS is "gone". Effectively resulting in a DOS attack as the HA server keeps getting rebooted.. Any thoughts on CSA futures to avoid this??

[jimwelsh]

Could you use IDS with TCP Reset to detect and reset the connections implementing the attacks? I haven't researched for you, but perhaps Signatures already exist in Cisco's definitions to detect known LSASS and RCP buffer overflow expolits, or custom Sigs could be constructed from information from other sources (Snort signatures, CVS, etc.)

Just a thought.