Search...

TippingPoint detection bypass

2007-07-12T00:00:00

ID SECURITYVULNS:DOC:17468
Type securityvulns
Reporter Securityvulns
Modified 2007-07-12T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

(The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSEC-Security_Pre-Advisory_3Com_TippingPoint_IPS_Detection_Bypass_2.pdf )

CYBSEC S.A. www.cybsec.com

Pre-Advisory Name: TippingPoint detection bypass

Vulnerability Class: Design flaw

Release Date: 2007-07-04

Affected Platforms:

TippingPoint IPS running TOS versions 2.1.x, 2.2.x prior to 2.2.5, and 2.5.x prior to 2.5.2

Local / Remote: Remote

Severity: High

Author: Andres Riancho

Vendor Status:

Confirmed, updates released.

Reference to Vulnerability Disclosure Policy:

http://www.cybsec.com/vulnerability_policy.pdf

Product Overview:

"The TippingPoint Intrusion Prevention System (IPS) is an award-winning security solution that blocks worms, viruses, Trojans, Denial of Service and Distributed Denial of Service attacks, Spyware, VoIP threats, and Peer-to-Peer threats. Inspecting traffic through Layer 7, the IPS blocks malicious traffic before damage occurs."

Vulnerability Description:

When IP packets are fragmented in a special way, the appliance fails to correctly reassemble the data stream.

Technical Details:

Technical details will be released 30 days after publication of this pre-advisory. This was agreed upon with TippingPoint to allow their customers to upgrade affected software prior to technical knowledge been publicly available.

Impact:

Exploiting this vulnerability, an attacker would be able to bypass all filters and detection.

Solutions:

TippingPoint has released a new version of the TippingPoint OS to address this vulnerability. Customers should apply the new firmware immediately. More information can be found at http://www.3com.com/securityalert/alerts/3COM-07-002.html

Vendor Response:

2006-02-06: Initial Vendor Contact.
2006-06-20: Vendor Confirmed Vulnerability.
2007-07-04: Vendor Releases Update.

Contact Information:

For more information regarding the vulnerability feel free to contact the author at ariancho {at} cybsec.com.

Andres Riancho CYBSEC S.A. Security Systems E-mail: ariancho@cybsec.com PGP key: http://www.cybsec.com/pgp/ariancho.txt Tel/Fax: [54 11] 4371-4444 Web: http://www.cybsec.com

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFGlMsB1351/apVCtIRArLwAJ9ntxG9m3NXMtEsue4NyukuujQetACfdRgJ d0RW2DQcKlpmc97RhmhSt0U= =gwf5 -----END PGP SIGNATURE-----

JSON Vulners Source

Initial Source

{"id": "SECURITYVULNS:DOC:17468", "bulletinFamily": "software", "title": "TippingPoint detection bypass", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n(The following advisory is also available in PDF format for download at:\r\nhttp://www.cybsec.com/vuln/CYBSEC-Security_Pre-Advisory_3Com_TippingPoint_IPS_Detection_Bypass_2.pdf\r\n)\r\n \r\n \r\nCYBSEC S.A.\r\nwww.cybsec.com\r\n \r\n \r\nPre-Advisory Name: TippingPoint detection bypass\r\n==================\r\n \r\nVulnerability Class: Design flaw\r\n====================\r\n \r\nRelease Date: 2007-07-04\r\n=============\r\n \r\nAffected Platforms:\r\n===================\r\n* TippingPoint IPS running TOS versions 2.1.x, 2.2.x prior to 2.2.5,\r\nand 2.5.x prior to 2.5.2\r\n \r\nLocal / Remote: Remote\r\n===============\r\n \r\nSeverity: High\r\n=========\r\n \r\nAuthor: Andres Riancho\r\n=======\r\n \r\nVendor Status:\r\n==============\r\n* Confirmed, updates released.\r\n \r\nReference to Vulnerability Disclosure Policy:\r\n=============================================\r\nhttp://www.cybsec.com/vulnerability_policy.pdf\r\n \r\nProduct Overview:\r\n=================\r\n"The TippingPoint Intrusion Prevention System (IPS) is an\r\naward-winning security solution that blocks worms,\r\nviruses, Trojans, Denial of Service and Distributed Denial of Service\r\nattacks, Spyware, VoIP threats, and\r\nPeer-to-Peer threats. Inspecting traffic through Layer 7, the IPS\r\nblocks malicious traffic before damage occurs."\r\n \r\nVulnerability Description:\r\n==========================\r\nWhen IP packets are fragmented in a special way, the appliance fails\r\nto correctly reassemble the data stream.\r\n \r\nTechnical Details:\r\n==================\r\nTechnical details will be released 30 days after publication of this\r\npre-advisory.\r\nThis was agreed upon with TippingPoint to allow their customers to\r\nupgrade affected software prior to technical\r\nknowledge been publicly available.\r\n \r\nImpact:\r\n=======\r\nExploiting this vulnerability, an attacker would be able to bypass all\r\nfilters and detection.\r\n \r\nSolutions:\r\n==========\r\nTippingPoint has released a new version of the TippingPoint OS to\r\naddress this vulnerability. Customers\r\nshould apply the new firmware immediately. More information can be\r\nfound at\r\nhttp://www.3com.com/securityalert/alerts/3COM-07-002.html\r\n \r\n \r\nVendor Response:\r\n================\r\n* 2006-02-06: Initial Vendor Contact.\r\n* 2006-06-20: Vendor Confirmed Vulnerability.\r\n* 2007-07-04: Vendor Releases Update.\r\n \r\n \r\nContact Information:\r\n====================\r\nFor more information regarding the vulnerability feel free to contact\r\nthe author at ariancho {at} cybsec.com.\r\n \r\nFor more information regarding CYBSEC: www.cybsec.com\r\n(c) 2006 - CYBSEC S.A. Security Systems\r\n\r\n- --\r\n- ----------------------------\r\nAndres Riancho\r\nCYBSEC S.A. Security Systems\r\nE-mail: ariancho@cybsec.com\r\nPGP key: http://www.cybsec.com/pgp/ariancho.txt\r\nTel/Fax: [54 11] 4371-4444\r\nWeb: http://www.cybsec.com\r\n- -----------------------------\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.6 (GNU/Linux)\r\nComment: Using GnuPG with Mozilla - http://enigmail.mozdev.org\r\n\r\niD8DBQFGlMsB1351/apVCtIRArLwAJ9ntxG9m3NXMtEsue4NyukuujQetACfdRgJ\r\nd0RW2DQcKlpmc97RhmhSt0U=\r\n=gwf5\r\n-----END PGP SIGNATURE-----", "published": "2007-07-12T00:00:00", "modified": "2007-07-12T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:17468", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:22", "edition": 1, "viewCount": 6, "enchantments": {"score": {"value": 1.6, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7919"]}], "rev": 4}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7919"]}]}, "exploitation": null, "vulnersScore": 1.6}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645494733}}