bugtraq - 8e6 Technologies R3000 Internet Filter Bypass by Request Split

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080116025520.8057.qmail@securityfocus.com>
Date: 16 Jan 2008 02:55:20 -0000
From: nnposter@...closed.not
To: bugtraq@...urityfocus.com
Subject: 8e6 Technologies R3000 Internet Filter Bypass by Request Split

8e6 Technologies R3000 Internet Filter Bypass by Request Split

Product:

8e6 Technologies R3000 Internet Filter
http://www.8e6.com/network-security/internet-filtering/internet-filtering.html

The HTTP URL filtering function provided by the 8e6 Technologies R3000 Internet Filter can be bypassed by simply splitting the HTTP request line (which contains the URI) into multiple packets.

Example:

packet 1: GE
packet 2: T / HTTP/1.0\r\n

This weakness is present regardless whether the site block is based on the DNS name or the IP address. For circumventing blocks based solely on the DNS name it is sufficient to arrange the HTTP request so that the request line and the Host header end up in separate packets.

Example:

packet 1: GET / HTTP/1.0
          X-SomeHeader: ...
          ....

packet 2: X-SomeOtherHeader: ....
          Host: www.blocked.com
          ...

The vulnerability has been identified in version 2.0.05.33. However, other versions may be also affected.

Solution:
Use a filtering solution that performs an HTTP request reassembly.

Found by:
nnposter