Lucene search

[email protected]CVE-2001-0669

HistoryOct 30, 2001 - 5:00 a.m.

CVE-2001-0669

2001-10-3005:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

intrusion detection system

ids

security vulnerability

unicode encoding evasion

http attacks

cve-2001-0669.

6.9 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.072 Low

EPSS

Percentile

94.0%

JSON

Various Intrusion Detection Systems (IDS) including (1) Cisco Secure Intrusion Detection System, (2) Cisco Catalyst 6000 Intrusion Detection System Module, (3) Dragon Sensor 4.x, (4) Snort before 1.8.1, (5) ISS RealSecure Network Sensor 5.x and 6.x before XPU 3.2, and (6) ISS RealSecure Server Sensor 5.5 and 6.0 for Windows, allow remote attackers to evade detection of HTTP attacks via non-standard “%u” Unicode encoding of ASCII characters in the requested URL.

CPENameOperatorVersion
iss:realsecure_server_sensoriss realsecure server sensoreq5.5
iss:realsecure_network_sensoriss realsecure network sensoreq6.x
iss:realsecure_server_sensoriss realsecure server sensoreq6.0
cisco:catalyst_6000_intrusion_detection_system_modulecisco catalyst 6000 intrusion detection system moduleeq*
snort:snortsnorteq1.8.1
iss:realsecure_network_sensoriss realsecure network sensoreq5.x
cisco:secure_intrusion_detection_systemcisco secure intrusion detection systemeq*
enterasys:dragonenterasys dragoneq4.x

CPE	Name	Operator	Version
iss:realsecure_server_sensor	iss realsecure server sensor	eq	5.5
iss:realsecure_network_sensor	iss realsecure network sensor	eq	6.x
iss:realsecure_server_sensor	iss realsecure server sensor	eq	6.0
cisco:catalyst_6000_intrusion_detection_system_module	cisco catalyst 6000 intrusion detection system module	eq	*
snort:snort	snort	eq	1.8.1
iss:realsecure_network_sensor	iss realsecure network sensor	eq	5.x
cisco:secure_intrusion_detection_system	cisco secure intrusion detection system	eq	*
enterasys:dragon	enterasys dragon	eq	4.x

References

marc.info/?l=bugtraq&m=99972950200602&w=2

www.cisco.com/warp/public/707/cisco-intrusion-detection-obfuscation-vuln-pub.shtml

www.kb.cert.org/vuls/id/548515

www.securityfocus.com/bid/3292

xforce.iss.net/alerts/advise95.php

6.9 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.072 Low

EPSS

Percentile

94.0%

JSON

Related for CVE-2001-0669

cert1 securityvulns1