Multiple Cisco Products WebSense Content Filtering Bypass Vulnerability

Bugtraq ID:	17883
Class:	Design Error
CVE:	CVE-2006-0515
Remote:	Yes
Local:	No
Published:	May 08 2006 12:00AM
Updated:	May 09 2006 09:09PM
Credit:	Discovered by George D. Gal <[email protected]>.
Vulnerable:	Cisco PIX/ASA 7.0.4 .3 Cisco PIX/ASA 7.0.4 Cisco PIX/ASA 7.0.1 .4 Cisco PIX/ASA 7.0 Cisco PIX Firewall 525 6.3 Cisco PIX Firewall 6.3.3 (133) Cisco PIX Firewall 6.3.2 Cisco PIX Firewall 6.3.1 Cisco PIX Firewall 6.3 (5) Cisco PIX Firewall 6.3 (3.109) Cisco PIX Firewall 6.3 (3.102) Cisco PIX Firewall 6.3 (3) Cisco PIX Firewall 6.3 (1) Cisco PIX Firewall 6.3 Cisco PIX Firewall 6.2.3 (110) Cisco PIX Firewall 6.2.3 Cisco PIX Firewall 6.2.2 .111 Cisco PIX Firewall 6.2.2 Cisco PIX Firewall 6.2.1 Cisco PIX Firewall 6.2 (3.100) Cisco PIX Firewall 6.2 (3) Cisco PIX Firewall 6.2 (2) Cisco PIX Firewall 6.2 (1) Cisco PIX Firewall 6.2 Cisco PIX Firewall 6.1.5 (104) Cisco PIX Firewall 6.1.5 Cisco PIX Firewall 6.1.4 Cisco PIX Firewall 6.1.3 Cisco PIX Firewall 6.1 (5) Cisco PIX Firewall 6.1 (4) Cisco PIX Firewall 6.1 (3) Cisco PIX Firewall 6.1 (2) Cisco PIX Firewall 6.1 (1) Cisco PIX Firewall 6.1 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 6.0.4 Cisco PIX Firewall 6.0.3 Cisco PIX Firewall 6.0 (4.101) Cisco PIX Firewall 6.0 (4) Cisco PIX Firewall 6.0 (2) Cisco PIX Firewall 6.0 (1) Cisco PIX Firewall 6.0 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 5.3 (3) Cisco PIX Firewall 5.3 (2) Cisco PIX Firewall 5.3 (1.200) Cisco PIX Firewall 5.3 (1) Cisco PIX Firewall 5.3 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 5.2 (9) Cisco PIX Firewall 5.2 (7) Cisco PIX Firewall 5.2 (6) Cisco PIX Firewall 5.2 (5) Cisco PIX Firewall 5.2 (3.210) Cisco PIX Firewall 5.2 (2) Cisco PIX Firewall 5.2 (1) Cisco PIX Firewall 5.2 Cisco PIX Firewall 5.1.4 Cisco PIX Firewall 5.1 (4.206) Cisco PIX Firewall 5.1 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 5.0 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 4.4 (8) Cisco PIX Firewall 4.4 (7.202) Cisco PIX Firewall 4.4 (4) Cisco PIX Firewall 4.4 Cisco PIX Firewall 4.3 Cisco PIX Firewall 4.2.2 Cisco PIX Firewall 4.2.1 Cisco PIX Firewall 4.2 (5) Cisco PIX Firewall 4.2 Cisco PIX Firewall 4.1.6 b Cisco PIX Firewall 4.1.6 Cisco PIX Firewall 4.0 Cisco PIX Firewall 3.1 Cisco PIX Firewall 3.0 Cisco PIX Firewall 2.7 Cisco Gigabit Switch Router 6.1 del Cisco Firewall Services Module (FWSM) 3.1 Cisco Firewall Services Module (FWSM) 2.3
Not Vulnerable:	Cisco PIX/ASA 7.1(2) Cisco PIX/ASA 7.0(5) Cisco PIX Firewall 6.3.5 (112) Cisco Firewall Services Module (FWSM) 3.1(1.7) Cisco Firewall Services Module (FWSM) 2.3(4)

Multiple Cisco Products WebSense Content Filtering Bypass Vulnerability

Multiple Cisco products are susceptible to a content-filtering bypass vulnerability. This issue is due to a failure of the software to properly recognize HTTP request traffic.

This issue allows users to bypass content-filtering and access forbidden websites.

Cisco is tracking this issue as Bug IDs CSCsc67612, CSCsc68472, and CSCsd81734.http://www.cisco.com/pcgi-bin/Support/Bugtool/onebug.pl?bugid=CSCsd81734

Multiple Cisco Products WebSense Content Filtering Bypass Vulnerability

Attackers can use standard network utilities to exploit this issue.

The following Java application may be used to demonstrate this issue:

• /data/vulnerabilities/exploits/WebsenseBypassProxy.java

Multiple Cisco Products WebSense Content Filtering Bypass Vulnerability

Solution:
The vendor has released an advisory, along with fixes to address this issue. Please see the referenced advisory for further information on obtaining fixes.

Multiple Cisco Products WebSense Content Filtering Bypass Vulnerability

References:

• Cisco PIX Firewall Product Homepage (Cisco Systems)
  
• VSR Advisory: WebSense content filter bypass when deployed in conjunction with C (VSR Advisories )
  
• VSR Advisory: WebSense content filter bypass when deployed in conjunction with C (Matthew Cerha )