Finjan SurfinGate ASCII File Extension File Filter Circumvention Vulnerability

Bugtraq ID:	13959
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 14 2005 12:00AM
Updated:	Jun 14 2005 12:00AM
Credit:	Discovery is credited to <[email protected]>.
Vulnerable:	Finjan Software SurfinGate 7.0 SP3 Finjan Software SurfinGate 7.0 SP2
Not Vulnerable:

Finjan SurfinGate ASCII File Extension File Filter Circumvention Vulnerability

SurfinGate may allow an attacker to circumvent file filters.

It has been reported that an attacker may bypass SurfinGate file filtering rules by using ASCII encoding in the file name.

SurfinGate version 7.0 SP2 and 7.0 SP3 are reportedly vulnerable. Other versions may be affected as well.

Finjan SurfinGate ASCII File Extension File Filter Circumvention Vulnerability

An exploit is not required.

The following proof of concept is available:
http://www.example.com/ourpics/sware/Mustangworld%2escr

Finjan SurfinGate ASCII File Extension File Filter Circumvention Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Finjan SurfinGate ASCII File Extension File Filter Circumvention Vulnerability

References:

• SurfinGate Product Page (Finjan Software)
  
• URL-Encoding Problem in Finjan SurfinGate (=?UTF-8?B?RGFuaWVsIFNjaHLDtnRlcg==?= )