Multiple Vendor Content Filtering Bypass Vulnerabilities

Bugtraq ID:	11558
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 28 2004 12:00AM
Updated:	Oct 28 2004 12:00AM
Credit:	Discovery is credited to offtopic <[email protected]> and 3APA3A <[email protected]>.
Vulnerable:	Zone Labs ZoneAlarm Pro with Web Filtering 4.5.594 Tiny Firewall Pro 6.0.100 Microsoft Windows XP Professional SP2 Microsoft Windows XP Home SP2 Kerio Personal Firewall 4.0.16 Kerio Personal Firewall 4.0.10 Kerio Personal Firewall 4.0.9 Kerio Personal Firewall 4.0.8 Kerio Personal Firewall 4.0.7 Kerio Personal Firewall 4.0.6 Internet Security Systems BlackICE PC Protection 3.6 cch Internet Security Systems BlackICE PC Protection 3.6 ccg Internet Security Systems BlackICE PC Protection 3.6 ccf Internet Security Systems BlackICE PC Protection 3.6 cce Internet Security Systems BlackICE PC Protection 3.6 ccd Internet Security Systems BlackICE PC Protection 3.6 ccc Internet Security Systems BlackICE PC Protection 3.6 ccb Internet Security Systems BlackICE PC Protection 3.6 cca Internet Security Systems BlackICE PC Protection 3.6 cbz Internet Security Systems BlackICE PC Protection 3.6 cbr Internet Security Systems BlackICE PC Protection 3.6 cbd Internet Security Systems BlackICE PC Protection 3.6 .cno Internet Security Systems BlackICE PC Protection 3.6 .cbz Check Point Software VPN-1 Next Generation FP2 Check Point Software VPN-1 Next Generation FP1 Check Point Software VPN-1 Next Generation FP0 Check Point Software FireWall-1 Next Generation FP3 Check Point Software FireWall-1 Next Generation FP2 Check Point Software FireWall-1 Next Generation FP1 Check Point Software FireWall-1 Next Generation FP0 ATGuard ATGuard Personal Firewall 3.2 Agnitum Outpost Firewall 2.5 Agnitum Outpost Firewall 2.1
Not Vulnerable:

Multiple Vendor Content Filtering Bypass Vulnerabilities

It has been reported that several products are vulnerable to content filtering bypass issues.

These issues could allow a web client to access disallowed content from behind an affected product. Bypassing the content filter could potentially allow malicious code to be executed on a client system thought to be protected.

Checkpoint VPN-1 and Firewall-1 and Agnitum Outpost Pro have been confirmed vulnerable to some or all of these issues. Other products are likely vulnerable.

Multiple Vendor Content Filtering Bypass Vulnerabilities

There is no exploit code required.

Multiple Vendor Content Filtering Bypass Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Reportedly, some of these issues were fixed by Checkpoint in R55HFA10 but this has not been confirmed.

Some of these issues were also reported to have been fixed by Agnitum in Outpost version 2.5 but this has not been confirmed.

Multiple Vendor Content Filtering Bypass Vulnerabilities

References:

• Bypassing content filtering whitepaper (SECURITY.NNOV)
  
• Presentation: Bypassing client application protection techniques with notepad (3APA3A <[email protected]>)