NetGap Escaped And Encoded URL Filtering Bypass Vulneribility
BID:2798
Info
NetGap Escaped And Encoded URL Filtering Bypass Vulneribility
| Bugtraq ID: | 2798 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 28 2001 12:00AM |
| Updated: | May 28 2001 12:00AM |
| Credit: | This vulnerability was announced to Bugtraq by eDvice Security Services <[email protected]> on May 28, 2001. |
| Vulnerable: |
Spearhead Security NetGAP 300 Spearhead Security NetGAP 200 |
| Not Vulnerable: | |
Discussion
NetGap Escaped And Encoded URL Filtering Bypass Vulneribility
NetGAP is an internet security appliance distributed by Spearhead Security. The device is designed to provide a physical buffer between private and public networks, while allowing logical access through content filtering and access control.
A problem with the appliance makes it possible to bypass the URL filtering function. By encoding requests with escaped (%) URL requests, the requests are passed along by the appliance unchecked.
This makes it possible for users on either side of the appliance to pass escaped URLs, and potentially gain access to restricted resources.
NetGAP is an internet security appliance distributed by Spearhead Security. The device is designed to provide a physical buffer between private and public networks, while allowing logical access through content filtering and access control.
A problem with the appliance makes it possible to bypass the URL filtering function. By encoding requests with escaped (%) URL requests, the requests are passed along by the appliance unchecked.
This makes it possible for users on either side of the appliance to pass escaped URLs, and potentially gain access to restricted resources.