TippingPoint IPS Fragmented Packets Detection Bypass Vulnerability

Bugtraq ID:	24861
Class:	Input Validation Error
CVE:	CVE-2007-3711
Remote:	Yes
Local:	No
Published:	Jul 10 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Andres Riancho of Cybsec Security Systems is credited with discovering this vulnerability.
Vulnerable:	3Com TippingPoint IPS TOS 2.5.1 3Com TippingPoint IPS TOS 2.5 3Com TippingPoint IPS TOS 2.2.4 3Com TippingPoint IPS TOS 2.2.3 3Com TippingPoint IPS TOS 2.2.2 3Com TippingPoint IPS TOS 2.2.1 .6506 3Com TippingPoint IPS TOS 2.2.1 3Com TippingPoint IPS TOS 2.2 3Com TippingPoint IPS TOS 2.1.4 .6324 3Com TippingPoint IPS TOS 2.1 3Com TippingPoint IPS TOS 0 3Com TippingPoint IPS 0
Not Vulnerable:	3Com TippingPoint IPS TOS 2.5.2 3Com TippingPoint IPS TOS 2.2.5

TippingPoint IPS Fragmented Packets Detection Bypass Vulnerability

TippingPoint IPS is prone to a detection-bypass vulnerability because the appliance fails to properly handle fragmented packets.

A successful exploit of this issue may allow an attacker to bypass the filter and detection system of vulnerable appliances, allowing malicious traffic through. This will likely aid the attacker in further attacks.

TippingPoint IPS Fragmented Packets Detection Bypass Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TippingPoint IPS Fragmented Packets Detection Bypass Vulnerability

Solution:
The vendor has released updates to address this issue. Please contact the vendor for details on obtaining and applying the appropriate updates.

TippingPoint IPS Fragmented Packets Detection Bypass Vulnerability

References:

• 3COM-07-002 - TippingPoint�?� IPS Filter Bypass Vulnerability (TippingPoint)
  
• TippingPoit IPS Homepage (TippingPoint)
  
• TippingPoint detection bypass (Andres Riancho)