SurfControl's SuperScout Web Filter Fails to Block Packets Relayed Via Proxy Servers
|
|
SecurityTracker Alert ID: 1001801 |
|
SecurityTracker URL: http://securitytracker.com/id/1001801
|
|
CVE Reference:
CVE-2001-1465
(Links to External Site)
|
Updated: May 12 2008
|
Original Entry Date: Jun 21 2001
|
Impact:
Host/resource access via network
|
Exploit Included: Yes
|
|
Description:
It is reported that SurfControl's SuperScout Web Filter will not block connections that have been relayed via certain proxy servers. This could allow a remote user to access restricted web content.
It is reported that a remote user can bypass the filters by using a proxy server. SurfControl reportedly only analyzes packets that have both the HTTP GET request and "Host:" information. If the HTTP GET request is not in the same packet as the "Host:" information, SurfControl will reportedly ignore the connection and allow it to continue unmonitored.
The Source Message lists some proxy servers that can be used to exploit this vulnerability.
|
Impact:
A remote user can bypass the filters and access restricted web content.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.surfcontrol.com/products/superscout_for_business/super_scout/index.html (Links to External Site)
|
Cause:
State error
|
Underlying OS: Linux (Any), UNIX (Solaris - SunOS), Windows (NT), Windows (2000)
|
|
Message History:
None.
|
Source Message Contents
|
Subject: SurfControl SuperScout can be Bypassed Using Split Packets
|
You can bypass the software by using a proxy server before your traffic is
looked at by SurfControl SuperScout. SurfControl only looks at packets
that have the HTTP GET request and "Host:" information inside it. If you
split up the request, so that HTTP GET request is not in the same packet
as the "Host:" information then SurfControl will ignore the request, and
allow it to continue unmonitored.
You can easily split up HTTP requests by using a proxy server before you
get to the node that is doing the Internet monitoring.
Proxies types you can use:
1) If you have Compaq PC's or servers that are
<http://www.securiteam.com/securitynews/5SP0L203PK.html> not patched you
can proxy off the Insight Manager software.
2) If you have PERL installed you can use
<http://www.wiretrip.net/rfp/cansecwest/> RFProxy,
<http://www.securiteam.com/tools/5KP0N1F40E.html> HTTPush or
<http://packetstorm.securify.com/UNIX/cgi-scanners/pudding01.tar.gz>
Pudding. (These programs were intended for the testing of IDS evasion
techniques but work wonders for Internet monitoring/blocking evasion).
|
|
