Full Disclosure mailing list archives
Re: TippingPoint IPS Signature Evasion
From: 3APA3A <3APA3A () SECURITY NNOV RU>
Date: Wed, 11 Jul 2007 18:30:04 +0400
Dear Paul Craig, --Wednesday, July 11, 2007, 1:37:03 AM, you wrote to bugtraq () securityfocus com: PC> http://www.test.com/scripts%c0%afcmd.exe PC> http://www.test.com/scripts%e0%80%afcmd.exe PC> http://www.test.com/scripts%c1%9ccmd.exe PC> Web servers located behind a Tippingpoint IPS device which are capable PC> of decoding alternate Unicode characters can be accessed, and exploited PC> without triggering the IPS device. Can you, please, provide example of such server? Fatih Ozavci reported similar problem with Checkpoint and Halfwidth/Fullwidth Unicode, potential attack vector was IIS with .Net framework, in this case IIS seems not to be exploitable. Blaming IPS it does not detect attack which is impossible in-the-wild is nonsense. Blaming corporate-level IPS doesn't detect attack against SOHO web server is acceptable nonsense :) -- ~/ZARAZA http://securityvulns.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- TippingPoint IPS Signature Evasion Paul Craig (Jul 11)
- Re: TippingPoint IPS Signature Evasion 3APA3A (Jul 11)
- Re: TippingPoint IPS Signature Evasion Paul Craig (Jul 12)
- Re: TippingPoint IPS Signature Evasion 3APA3A (Jul 11)