8e6 Technologies R3000 Internet Filter Bypass by Request Split

2008.01.22
Credit: nnposter
Risk: Low
Local: No
Remote: Yes
CWE: CWE-264


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

8e6 Technologies R3000 Internet Filter Bypass by Request Split Product: 8e6 Technologies R3000 Internet Filter http://www.8e6.com/network-security/internet-filtering/internet-filterin g.html The HTTP URL filtering function provided by the 8e6 Technologies R3000 Internet Filter can be bypassed by simply splitting the HTTP request line (which contains the URI) into multiple packets. Example: packet 1: GE packet 2: T / HTTP/1.0\r\n This weakness is present regardless whether the site block is based on the DNS name or the IP address. For circumventing blocks based solely on the DNS name it is sufficient to arrange the HTTP request so that the request line and the Host header end up in separate packets. Example: packet 1: GET / HTTP/1.0 X-SomeHeader: ... .... packet 2: X-SomeOtherHeader: .... Host: www.blocked.com ... The vulnerability has been identified in version 2.0.05.33. However, other versions may be also affected. Solution: Use a filtering solution that performs an HTTP request reassembly. Found by: nnposter


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top