HTTP: Half-Full Width Unicode Encoding and Double Encoding Bypass

This signatures detects unicode encoding in HTTP requests. Some IPS do not decode unicode in HTTP requests properly. An attacker can attempt to evade the IPS by using such encoding.

Extended Description

Multiple products are reportedly prone to a vulnerability that may allow malicious HTTP traffic to bypass detection. Attackers may send this type of HTTP data to evade detection and perform further attacks. Cisco has stated that all IOS releases that support the Firewall/IPS feature set are affected. Although we currently have no definitive list of such versions, Symantec is investigating the matter and will update this BID's list of vulnerable systems appropriately.

Affected Products

Cisco ios,Cisco intrusion_prevention_system

References

BugTraq: 23980

CVE: CVE-2007-2689

URL: http://www.gamasec.net/english/gs07-01.html http://www.kb.cert.org/vuls/id/739224 http://isc.sans.org/diary.html?storyid=2807

Short Name

HTTP:IIS:ENCODING:UNICODE-BP

Severity

Warning

Recommended

False

Recommended Action

None

HTTP: Half-Full Width Unicode Encoding and Double Encoding Bypass

Extended Description

Affected Products

References

Found a potential security threat?