Various problems in Ternd Micro AppletTrap Script filtering

["eDvice Security Services" <support () edvicesecurity com>]

Sunday 29 July 2001

Various problems in Ternd Micro AppletTrap Script filtering
===========================================================

This is a different advisory than the one we posted on July 9
(http://archives.neohapsis.com/archives/bugtraq/2001-07/0129.html).

Product Background
------------------
Trend Micro Applet Trap is a product for blocking malicious Java applets,
malicious JavaScript and unsecured ActiveX controls at the gateway. The
product includes an option for URL filtering.

Scope
------
eDvice recently conducted a test of AppletTrap's ability to filter Scripts
at the gateway. AppletTrap includes the ability to filter script languages
(JavaScript, VBScript, and/or all other HTML script languages) from HTML
code.

The Findings
--------------
AppletTrap includes some design and implementation flaws, which allow an
attacker to bypass restrictions set by the product administrator and
introduce malicious code into an organization.

Details
---------
We found two problems with AppletTrap's Script filtering mechanism:

1) If only JavaScript or VBScript (not both) filtering is enabled, then in
an html page containing a mixture of JavaScript and VBScript code,
AppletTrap will not filter scripts that should have been filtered by policy
as long as these scripts appear after a script that is allowed by policy.
For example, if the policy is set to filter only VBScript and not
JavaScript, then in a page containing a JavaScript and a VBScript, the
VBScript will not be filtered as long as the JavaScript code comes first.

2) AppletTrap does not recognize and does not filter scripting tags
constructed using extended Unicode notation. This is the same problem we
reported in http://archives.neohapsis.com/archives/bugtraq/2001-05/0285.html
(see also http://www.securityfocus.com/bid/2801) for a different product.

Version Tested
---------------
AppletTrap 2.0

Status and solution
--------------------
Trend Micro has confirmed these vulnerabilities and will address them in
version 2.5.


Discovered by eDvice on 11 July 2001.
http://www.edviceSecurity.com
Support () edviceSecurity com