bugtraq - URL-Encoding Problem in Finjan SurfinGate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <42AEE8BA.4070707@gmx.de>
Date: Tue, 14 Jun 2005 16:24:58 +0200
From: Daniel Schröter <d.schroeter@....de>
To: bugtraq@...urityfocus.com
Subject: URL-Encoding Problem in Finjan SurfinGate


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SUMMARY
- -------
The Finjan SurfinGate use web content filtering and internet access
management for protecting the network.

A vulnerability in the product allows you to bypass the access
management. You can download files which are normally blocked.


VERSIONS AFFECTED
- -----------------
Tested with SurfinGate Version 7.0SP2 and SP3 (and maybe others...)


DETAILS
- -------
A URL ASCII decode problem exists in the Finjan SurfinGate. If you use
ASCII encoding for a not allowed file the Finjan SufinGate can not block
it. Mostly it's enough to convert the dots to '%2e'. For example: you
can bypass a not allowed EXE-download or a double extension file like
file.jpg.exe.

If you block the content type of the file you can not bypass the Finjan
SurfinGate. But a hacker will not use a correct configured webserver for
infiltrate files in the company....

Finjan Software Ltd. has been notified for one year!


Proof of concept
- ----------------

(This example will not work if you block the content type in your
infrastructure, but there are some webservers out there with a wrong
content type for EXE-files.....)

Of course we don't take a normal exe-file. Let us use a screensaver.

If you block SCR-files the following will be blocked:
http://www.mustangworld.com/ourpics/sware/Mustangworld.scr

If you _just_ block the SCR-extension (and not the content type in you
infrastructure) your can bypass the Finjan SurfinGate with the following
link:
http://www.mustangworld.com/ourpics/sware/Mustangworld%2escr

Bye

	Daniel Schröter


- --
=========================================================
(gnu)PGP signierter Key vom heise c't Magazin verfügbar.
http://www.heise.de/security/dienste/pgp/
=========================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCrui60uIOmJO/NdERAgdAAKDo1xRPO/tXiiRkW1hL5oP53PUrYACfWS2u
kF8l2cInyHrWPaVqZouWnkg=
=k0Mw
-----END PGP SIGNATURE-----