Bypassing content filtering

There are common methods allowing to bypass almost any content filtering software antiviral products, CVP firewalls, mail attachment filters, etc. I believe multiple products are vulnerable. Contents: I. Bypassing attachment detection or invalid detection of attachment type. 1. Encoded filename o...

IIS Unicode Strings

Some of unicodes ... collected by cd http://bastardo.de/ apache ; /MSADC/root.exe?/c+dir /PBServer/..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+dir /PBServer/..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+dir /PBServer/..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+dir...

CVE-2001-1157

Baltimore Technologies WEBsweeper 4.0 and 4.02 are described as failing to properly filter Javascript from HTML pages, enabling remote bypass of the filter via (1) an extra leading

CVE-2001-1157

Baltimore Technologies WEBsweeper 4.0 and 4.02 does not properly filter Javascript from HTML pages, which could allow remote attackers to bypass the filtering via 1 an extra leading and one or more characters before the SCRIPT tag, or 2 tags using Unicode...

Another Sql Server 7 Buffer Overflow

Security Advisory Name : Another Sql Server 7 Buffer Overflow System Affected : Sql Server 7 all service packs and fixes, ver. 7.00.1021 Severity : High. Remote Exploit: Yes Author: Cesar Cerrudo. Date: 03/05/2002 Advisory Number: CC030202 Description : The extended stored procedure xpdirtree...

Details and exploitation of buffer overflow in mshtml.dll (and few sidenotes on Unicode overflows in general)

Dear, Advisory was originally posted in 1-3 2 weeks ago, so I think it's enough time passed to publish some details, because 4,5 have enough information to re-discover vulnerability. ERRor erroratpochtamt.ru discovered IE 5.5 and 6.0 in some cases crash on embed src="filename.AAAAAAAAAAlot of 'A'...

CVE-2001-0669

Various Intrusion Detection Systems IDS including 1 Cisco Secure Intrusion Detection System, 2 Cisco Catalyst 6000 Intrusion Detection System Module, 3 Dragon Sensor 4.x, 4 Snort before 1.8.1, 5 ISS RealSecure Network Sensor 5.x and 6.x before XPU 3.2, and 6 ISS RealSecure Server Sensor 5.5 and 6...

CVE-2001-0669

CVE-2001-0669 affects multiple IDS products (Cisco Secure IDS, Cisco Catalyst 6000 IDS Module, Dragon Sensor 4.x, Snort before 1.8.1, ISS RealSecure Network Sensor 5.x/6.x before XPU 3.2, and ISS RealSecure Server Sensor 5.5/6.0 for Windows) where an attacker can bypass HTTP attack detection by u...

CVE-2001-0669

Various Intrusion Detection Systems IDS including 1 Cisco Secure Intrusion Detection System, 2 Cisco Catalyst 6000 Intrusion Detection System Module, 3 Dragon Sensor 4.x, 4 Snort before 1.8.1, 5 ISS RealSecure Network Sensor 5.x and 6.x before XPU 3.2, and 6 ISS RealSecure Server Sensor 5.5 and 6...

CVE-2001-0709

Microsoft IIS 4.0 and before, when installed on a FAT partition, allows a remote attacker to obtain source code of ASP files via a URL encoded with Unicode...

ISS Security Alert: Multiple Vendor IDS Unicode Bypass Vulnerability

Internet Security Systems Security Alert September 5, 2001 Multiple Vendor IDS Unicode Bypass Vulnerability Synopsis: ISS X-Force is aware of a vulnerability in many commercial and open- source IDS Intrusion Detection System products that may allow attackers to evade detection. Microsoft Web serv...

Обход многих IDS через Unicode (protection bypass)

Используя Unicode-кодирование во многих протоколах возможно обойти защиту IDS...

Cisco Secure IDS 2.0/3.0 / Snort 1.x / ISS RealSecure 5/6 / NFR 5.0 - Encoded IIS Detection Evasion

source: https://www.securityfocus.com/bid/3292/info The Microsoft IIS web server supports a non-standard method of encoding web requests. Because this method is non-standard, intrusion detection systems may not detect attacks encoded using this method. This vulnerability only affects intrusion...

CVE-2001-0709

Microsoft IIS 4.0 and before, when installed on a FAT partition, allows a remote attacker to obtain source code of ASP files via a URL encoded with Unicode...

CVE-2001-0709

Vulnerability summary (CVE-2001-0709): Microsoft IIS 4.0 and earlier, when installed on a FAT partition, is susceptible to remote disclosure of ASP source code. An attacker can obtain the source by requesting a URL encoded with Unicode. The description in the provided documents confirms the expos...

CVE-2001-1455

Netegrity SiteMinder 3.6 through 4.5.1 allows remote attackers to bypass filtering via URLs containing Unicode characters...

CVE-2001-0521

Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent HTML SCRIPT filtering via the UNICODE encoding of SCRIPT tags within the HTML document...

CVE-2001-0601

Lotus Domino R5 prior to 5.0.7 allows a remote attacker to create a denial of service via HTTP requests containing certain combinations of UNICODE characters...

Обход Trend Micro AppletTrap (protection bypass)

Можно обойти защиту от Javascript Используя Unicode - кодировку...

CVE-2001-0601

CVE-2001-0601 affects Lotus Domino R5 before 5.0.7. The vulnerability allows a remote attacker to cause a denial of service by sending HTTP requests that contain certain combinations of UNICODE characters. The DoS is related to availability impact and is described as partial. Root cause is proces...