Bugtraq mailing list archives
RE: TippingPoint IPS Signature Evasion
From: "Paul Craig" <paul.craig () security-assessment com>
Date: Thu, 12 Jul 2007 08:44:26 +1200
This is exploitable (and tested) against IIS 5/5.1 (IIS6/7 are not vulnerable) However, potentially other web servers are also vulnerable if they are capable of decoding alternate unicode characters. I also agree with you, blaming an IPS for not detecting attack which is impossible in the wild would be very pointless. Although IIS 5 is old, it is still relatively common. Any further questions, feel free to ask. Cheers, Paul Craig Security Consultant Security-Assessment.com -----Original Message----- From: 3APA3A [mailto:3APA3A () SECURITY NNOV RU] Sent: Thursday, 12 July 2007 2:30 a.m. To: Paul Craig Cc: bugtraq () securityfocus com; full-disclosure () lists grok org uk Subject: Re: TippingPoint IPS Signature Evasion Dear Paul Craig, --Wednesday, July 11, 2007, 1:37:03 AM, you wrote to bugtraq () securityfocus com: PC> http://www.test.com/scripts%c0%afcmd.exe PC> http://www.test.com/scripts%e0%80%afcmd.exe PC> http://www.test.com/scripts%c1%9ccmd.exe PC> Web servers located behind a Tippingpoint IPS device which are capable PC> of decoding alternate Unicode characters can be accessed, and exploited PC> without triggering the IPS device. Can you, please, provide example of such server? Fatih Ozavci reported similar problem with Checkpoint and Halfwidth/Fullwidth Unicode, potential attack vector was IIS with .Net framework, in this case IIS seems not to be exploitable. Blaming IPS it does not detect attack which is impossible in-the-wild is nonsense. Blaming corporate-level IPS doesn't detect attack against SOHO web server is acceptable nonsense :) -- ~/ZARAZA http://securityvulns.com/
Current thread:
- TippingPoint IPS Signature Evasion Paul Craig (Jul 10)
- Re: TippingPoint IPS Signature Evasion 3APA3A (Jul 11)
- RE: TippingPoint IPS Signature Evasion Paul Craig (Jul 11)
- Re: TippingPoint IPS Signature Evasion 3APA3A (Jul 11)