bugtraq - GS07-01 Full-Width and Half-Width Unicode Encoding IDS/IPS/WAF Bypass Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <464954E8.3050807@gamasec.net>
Date: Tue, 15 May 2007 09:36:24 +0300
From: Fatih Ozavci <securitylists@...asec.net>
To: bugtraq@...urityfocus.com
Subject: GS07-01 Full-Width and Half-Width Unicode Encoding IDS/IPS/WAF Bypass
 Vulnerability

GS07-01 Full-Width and Half-Width Unicode Encoding IDS/IPS/WAF Bypass
Vulnerability

Date & Version : 04/14/2007 - 1.0

Description :

Various HTTP content scanning systems fail to properly scan
full-width/half-width Unicode encoded traffic. This may allow malicious
content to bypass HTTP content scanning systems.

HTTP Content Scanning Systems have a pre-processor to decode various
forms of HTTP encoded requests such as UTF encoding for attack signature
analysis. Full-width and half-width is an encoding technique for Unicode
characters. Various HTTP content scanning systems fail to properly scan
full-width/half-width Unicode encoded traffic.

Some Open Source or Microsoft Products such as Microsoft ISS and .NET
Framework properly decode this type of encoding. But most IDS/IPS/WAF
products does not properly decode full-width Unicode (%uff) encoded HTTP
requests for analysis, Lowercase/Uppercase conversion and character
matching. By sending HTTP traffic to a vulnerable content scanning
system, an attacker may be able to bypass the content scanning system.

Risk Level : High

Impact : Security Bypass

Systems Affected :

Checkpoint Web Intelligence (Confirmed)
IBM ISS Proventia Series (Confirmed)
Full List of Vendors : (CERT - Vulnerability Note VU#739224) [1]

Remedy :

Contact your vendor for a hotfix, patch or advanced configuration.

Credits :

Fatih Ozavci (GamaTEAM Member)
Caglar Cakici (GamaTEAM Member)
It's detected using GamaSEC Exploit Framework
GamaSEC Information Security Audit and Consulting Services
(www.gamasec.net)

Original Advisory Link :
http://www.gamasec.net/english/gs07-01.html

References :

   1. CERT - Vulnerability Note VU#739224
      http://www.kb.cert.org/vuls/id/739224

   2. Unicode Home Page
      http://unicode.org

   3. Unicode.org, Halfwidth and Fullwidth Forms
      http://www.unicode.org/charts/PDF/UFF00.pdf

-- 
Best Regards
Fatih Ozavci
IT Security Consultant