Re: TippingPoint IPS Signature Evasion

From: 3APA3A <3APA3A(at)SECURITY.NNOV.RU>
Date: Wed Jul 11 2007 - 10:30:04 EDT

Dear Paul Craig,

--Wednesday, July 11, 2007, 1:37:03 AM, you wrote to bugtraq@securityfocus.com:

PC> 
http://www.test.com/scripts%c0%afcmd.exe
PC> 
http://www.test.com/scripts%e0%80%afcmd.exe
PC> 
http://www.test.com/scripts%c1%9ccmd.exe

PC> Web servers located behind a Tippingpoint IPS device which are capable

PC> of decoding alternate Unicode characters can be accessed, and exploited PC> without triggering the IPS device.

Can you, please, provide example of such server? Fatih Ozavci reported similar problem with Checkpoint and Halfwidth/Fullwidth Unicode, potential attack vector was IIS with .Net framework, in this case IIS seems not to be exploitable.

Blaming IPS it does not detect attack which is impossible in-the-wild is nonsense. Blaming corporate-level IPS doesn't detect attack against SOHO web server is acceptable nonsense :)

--

~/ZARAZA http://securityvulns.com/ Received on Wed Jul 11 17:28:59 2007