[security-alerts] FW: [SA25285] Cisco Products HTTP Unicode Encoding Detection Bypass

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

;-)

> 
> TITLE:
> Cisco Products HTTP Unicode Encoding Detection Bypass
> 
> SECUNIA ADVISORY ID:
> SA25285
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/25285/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> Security Bypass
> 
> WHERE:
> From remote
> 
> OPERATING SYSTEM:
> Cisco Intrusion Prevention System (IPS) 5.x
> http://secunia.com/product/5600/
> 
> SOFTWARE:
> Cisco IOS Firewall Feature Set 12.x
> http://secunia.com/product/721/
> Cisco IOS Firewall Feature Set 11.x
> http://secunia.com/product/722/
> 
> DESCRIPTION:
> A vulnerability has been reported in various Cisco products, which
> can be exploited by malicious people to bypass certain security
> restrictions.
> 
> The vulnerability is caused due to an error in the handling of
> full-width and half-width unicode encoded HTTP traffic. This can be
> exploited to bypass content scanning and evade detection by an IPS or
> firewall.
> 
> The vulnerability affects the following products:
> * Cisco Intrusion Prevention System (IPS)
> * Cisco IOS with Firewall/IPS Feature Set
> 
> SOLUTION:
> No fix or workaround is currently available.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Fatih Ozavci and Caglar Cakici, GamaSEC
> 
> ORIGINAL ADVISORY:
> Cisco:
> http://www.cisco.com/warp/public/707/cisco-sr-20070514-unicode.shtml
> 
> GamaSEC:
> http://www.gamasec.net/english/gs07-01.html
> 
> OTHER REFERENCES:
> US-CERT VU#739224:
> http://www.kb.cert.org/vuls/id/739224
>