TippingPoint IPS Signature Evasion

• TippingPoint IPS Signature Evasion
  =
  
• Vendor Website:
• http://www.tippingpoint.com
  =
  
• Affected Version:
• TippingPoint IPS running TOS versions 2.1 & 2.2.0 - 2.2.4
  =
  
• Vendor Notified. 18th January 2006
• Public Disclosure. 11th July 2007
  =
  http://security-assessment.com/files/advisories/2007-07-11_Tippingpoint_IPS_ Signature_Evasion.pdf

  ---

  • Overview ==

During security analysis of the Tippingpoint IPS product a signature evasion vulnerability was discovered. The use of specific Unicode characters on particular web servers allows a remote user to bypass IPS detection.

• Exploitation ==

By using a hex encoded alternate Unicode character for forward slash (/) a request can be produced that will not match any IPS signature present in the TippingPoint device.

Example:
http://www.test.com/scripts/cmd.exe is a known attack, and detected by a signature.

The same URI with alternate Unicode forward slash characters are not detected by the signature.  

http://www.test.com/scripts%c0%afcmd.exehttp://www.test.com/scripts%e0%80%afcmd.exehttp://www.test.com/scripts%c1%9ccmd.exe

Web servers located behind a Tippingpoint IPS device which are capable of decoding alternate Unicode characters can be accessed, and exploited without triggering the IPS device.

• Solutions ==

Security-Assessment.com has been in contact with Tipping and a new version of the Tippingpoint IPS software has been released to address the discovered vulnerability.
This issue has been addressed in various TOS releases as indicated by the affected product below.

• X-Family devices, 2.5.0.6682.
• non-X-Family device (not including 600E, 1200E, 2400E or 5000E), 2.5.1.6826.
• non-X-Family device (including 600E, 1200E, 2400E or 5000E), 2.5.2.6919. http://www.3com.com/securityalert/alerts/3COM-07-003.html
  • Credit ==

Discovered and advised to Tippingpoint January 18th 2006 by Paul Craig of Security-Assessment.com

• About Security-Assessment.com ==

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

About Security-Assessment.com
Security-Assessment.com is Australasia's leading team of Information Security consultants specialising in providing high quality Information Security services to clients throughout the Asia Pacific region. Our clients include some of the largest globally recognised companies in areas such as finance, telecommunications, broadcasting, legal and government. Our aim is to provide the very best independent advice and a high level of technical expertise while creating long and lasting professional relationships with our clients.

Security-Assessment.com is committed to security research and development, and its team continues to identify and responsibly publish vulnerabilities in public and private software vendor's products. Members of the Security-Assessment.com R&D team are globally recognised through their release of whitepapers and presentations related to new security research.

Security-Assessment.com is an Endorsed Commonwealth Government of Australia supplier and sits on the Australian Government Attorney-General's Department Critical Infrastructure Project panel. We are certified by both Visa and MasterCard under their Payment Card Industry Data Security Standard Programs.

Paul Craig
Security Consultant
Security-Assessment.com Received on Tue Jul 10 18:45:54 2007