SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Intrusion Detection)  >   TippingPoint Intrusion Prevention System Vendors:   3Com
TippingPoint Intrusion Prevention System Alternate Unicode Character Encodings Lets Remote Users Evade Detection
SecurityTracker Alert ID:  1018361
SecurityTracker URL:  http://securitytracker.com/id/1018361
CVE Reference:   CVE-2007-3701   (Links to External Site)
Updated:  May 6 2008
Original Entry Date:  Jul 11 2007
Impact:   Host/resource access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 2.1, 2.2.0 - 2.2.4
Description:   A vulnerability was reported in TippingPoint Intrusion Prevention System. A remote user can evade detection.

A remote user can send specially encoded data to avoid detection by the IPS. Specific Unicode encoding for the forward slash character can be used to cause the request to fail to match IPS signatures.

Some web servers will properly decode these characters.

Some demonstration exploit URLs are provided:

http://[target]/scripts%c0%afcmd.exe
http://[target]/scripts%e0%80%afcmd.exe
http://[target]/scripts%c1%9ccmd.exe

The vendor was notified on January 18, 2006.

Paul Craig of Security-Assessment.com discovered this vulnerability.

The original advisory is available at:

http://security-assessment.com/files/advisories/2007-07-11_Tippingpoint_IPS_Signature_Evasion.pdf

Impact:   A remote user can evade intrusion detection.
Solution:   The vendor has issued fixed versions.

The 3Com/TippingPoint advisory is available at:

http://www.3com.com/securityalert/alerts/3COM-07-003.html

Vendor URL:  www.3com.com/securityalert/alerts/3COM-07-003.html (Links to External Site)
Cause:   Input validation error

Message History:   None.


 Source Message Contents

Subject:  TippingPoint IPS Signature Evasion

========================================================================
= TippingPoint IPS Signature Evasion
=
= Vendor Website: 
= http://www.tippingpoint.com
=
= Affected Version:
=  TippingPoint IPS running TOS versions 2.1 & 2.2.0 - 2.2.4
=
= Vendor Notified.     18th January 2006
= Public Disclosure.   11th July 2007
=
http://security-assessment.com/files/advisories/2007-07-11_Tippingpoint_IPS_
Signature_Evasion.pdf
========================================================================


== Overview ==

During security analysis of the Tippingpoint IPS product a signature 
evasion vulnerability was discovered. The use of specific Unicode characters
on particular web servers allows a remote user to bypass IPS detection.

== Exploitation ==

By using a hex encoded alternate Unicode character for forward slash (/)
a request can be produced that will not match any IPS signature present
in the TippingPoint device.

Example:
http://www.test.com/scripts/cmd.exe is a known attack, and detected by a
signature.

The same URI with alternate Unicode forward slash characters are not 
detected by the signature.
 
http://www.test.com/scripts%c0%afcmd.exe
http://www.test.com/scripts%e0%80%afcmd.exe
http://www.test.com/scripts%c1%9ccmd.exe

Web servers located behind a Tippingpoint IPS device which are capable
of decoding alternate Unicode characters can be accessed, and exploited 
without triggering the IPS device.

== Solutions ==

Security-Assessment.com has been in contact with Tipping and a new version
of the Tippingpoint IPS software has been released to address the 
discovered vulnerability.
This issue has been addressed in various TOS releases as indicated
by the affected product below.
  - X-Family devices, 2.5.0.6682.
  - non-X-Family device (not including 600E, 1200E,
  	2400E or 5000E), 2.5.1.6826.
  - non-X-Family device (including 600E, 1200E, 2400E
   or 5000E), 2.5.2.6919.
http://www.3com.com/securityalert/alerts/3COM-07-003.html

== Credit ==

Discovered and advised to Tippingpoint January 18th 2006
by Paul Craig of Security-Assessment.com

== About Security-Assessment.com ==

About Security-Assessment.com
Security-Assessment.com is Australasia's leading team of Information 
Security consultants specialising in providing high quality Information
Security services to clients throughout the Asia Pacific region. Our 
clients include some of the largest globally recognised companies in
areas such as finance, telecommunications, broadcasting, legal and
government. Our aim is to provide the very best independent advice
and a high level of technical expertise while creating long and lasting
professional relationships with our clients.

Security-Assessment.com is committed to security research and development,
and its team continues to identify and responsibly publish vulnerabilities
in public and private software vendor's products. Members of the
Security-Assessment.com R&D team are globally recognised through their
release of whitepapers and presentations related to new security research.

Security-Assessment.com is an Endorsed Commonwealth Government of Australia
supplier and sits on the Australian Government Attorney-General's Department
Critical Infrastructure Project panel. We are certified by both Visa and
MasterCard under their Payment Card Industry Data Security Standard
Programs.


Paul Craig
Security Consultant
Security-Assessment.com



 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC