ips-evasion.txt

Summarized from https://strikecenter.bpointsys.com/ Many commercial IPS products fail to decode HTTP requests which use 0x0c, 0x0b, and 0x0d instead of the normal 0x20/0x09 separators. A request in the following format will evade most IPS protocol decoders: $ echo -ne...

SOL7544 - Full-width and half-width Unicode encoded data bypasses IDS/IPS security controls, VU #739224

Unicode is a system for encoding characters of a character set, which is used in networked applications. IDS/IPS or other security devices may fail to decode and recognize the characters that represent an attack if encoded in Unicode, and pass the characters to a target device. If the target devi...

ZDI-07-038: Microsoft Internet Explorer Prototype Dereference Code Execution Vulnerability

ZDI-07-038: Microsoft Internet Explorer Prototype Dereference Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-038.html June 12, 2007 -- CVE ID: CVE-2007-1751 -- Affected Vendor: Microsoft -- Affected Products: Internet Explorer 6.x Internet Explorer 7.x --...

TPTI-07-09: Macrovision FLEXnet boisweb.dll ActiveX Control Buffer Overflow Vulnerability

TPTI-07-09: Macrovision FLEXnet boisweb.dll ActiveX Control Buffer Overflow Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-07-09 June 4, 2007 -- CVE ID: CVE-2007-2419 -- Affected Vendor: Macrovision -- Affected Products: Update Service 3.x Update Service 4.x Update Service 5.x FLEXnet...

TPTI-07-10: Centennial Software XferWan.exe Stack Overflow Vulnerability

TPTI-07-10: Centennial Software XferWan.exe Stack Overflow Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-07-10 June 4, 2007 -- CVE ID: CVE-2007-2514 -- Affected Vendor: Centennial Software -- Affected Products: Symantec Discovery 6.5 -- TippingPointTM IPS Customer Protection:...

Cross site request forgery (csrf)

The 3Com TippingPoint IPS do not properly handle certain full-width and half-width Unicode character encodings in an HTTP POST request, which might allow remote attackers to evade detection of HTTP traffic...

CVE-2007-2734

The 3Com TippingPoint IPS do not properly handle certain full-width and half-width Unicode character encodings in an HTTP POST request, which might allow remote attackers to evade detection of HTTP traffic...

CVE-2007-2734

The CVE-2007-2734 entry concerns the 3Com TippingPoint IPS failing to properly handle certain full-width/half-width Unicode encodings in HTTP POST requests, which could allow remote attackers to evade detection of HTTP traffic. Affected product: 3Com TippingPoint IPS. Root cause: improper encodin...

CVE-2007-2734

The 3Com TippingPoint IPS do not properly handle certain full-width and half-width Unicode character encodings in an HTTP POST request, which might allow remote attackers to evade detection of HTTP traffic...

Code injection

The Cisco Intrusion Prevention System IPS and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic...

CVE-2007-2688

The Cisco Intrusion Prevention System IPS and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic...

CVE-2007-2688

The CVE-2007-2688 issue affects Cisco’s Intrusion Prevention System (IPS) and IOS with Firewall/IPS Feature Set. The vulnerability arises from improper handling of certain full-width and half-width Unicode encodings, which could allow remote attackers to evade detection of HTTP traffic. What’s af...

CVE-2007-2688

The Cisco Intrusion Prevention System IPS and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic...

GS07-01 Full-Width and Half-Width Unicode Encoding IDS/IPS/WAF Bypass Vulnerability

GS07-01 Full-Width and Half-Width Unicode Encoding IDS/IPS/WAF Bypass Vulnerability Date & Version : 04/14/2007 - 1.0 Description : Various HTTP content scanning systems fail to properly scan full-width/half-width Unicode encoded traffic. This may allow malicious content to bypass HTTP content...

CVE-2007-2688: Undefined Security Weakness

The Cisco Intrusion Prevention System IPS and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic...

CVE-2007-2734: Undefined Security Weakness

The 3Com TippingPoint IPS do not properly handle certain full-width and half-width Unicode character encodings in an HTTP POST request, which might allow remote attackers to evade detection of HTTP traffic...

TPTI-07-07: Apple QuickTime STSD Parsing Heap Overflow Vulnerability

TPTI-07-07: Apple QuickTime STSD Parsing Heap Overflow Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-07-07 May 10, 2007 -- CVE ID: CVE-2007-0754 -- Affected Vendor: Apple -- Affected Products: QuickTime Player 7.x -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers...

ZDI-07-024: Trend Micro ServerProtect EarthAgent Stack Overflow Vulnerability

ZDI-07-024: Trend Micro ServerProtect EarthAgent Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-024.html May 7, 2007 -- CVE ID: CVE-2007-2508 -- Affected Vendor: Trend Micro -- Affected Products: ServerProtect v5.58 -- TippingPointTM IPS Customer Protection:...

ZDI-07-026: Microsoft Excel BIFF File Format Named Graph Record Parsing Stack Overflow Vulnerability

ZDI-07-026: Microsoft Excel BIFF File Format Named Graph Record Parsing Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-026.html May 8, 2007 -- CVE ID: CVE-2007-0215 -- Affected Vendor: Microsoft -- Affected Products: Office Excel 2000 Office Excel 2002 Office Exce...

TPTI-07-06: Trillian Pro Rendezvous XMPP HTML Decoding Heap Corruption

TPTI-07-06: Trillian Pro Rendezvous XMPP HTML Decoding Heap Corruption http://dvlabs.tippingpoint.com/advisory/TPTI-07-06 May 2, 2007 -- CVE ID: CVE-2007-2418 -- Affected Vendor: Cerulean Studios -- Affected Products: Trillian Pro 3.1 build 121 and below -- TippingPointTM IPS Customer Protection:...