Foundry Networks ServerIron Encoded URI Load Balancing Bypass Weakness
BID:4286
Info
Foundry Networks ServerIron Encoded URI Load Balancing Bypass Weakness
| Bugtraq ID: | 4286 |
| Class: | Design Error |
| CVE: |
CVE-2002-0452 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 13 2002 12:00AM |
| Updated: | Jul 11 2009 11:56AM |
| Credit: | Discovered by Frank DENIS <[email protected]>. |
| Vulnerable: |
Foundry Networks ServerIronXL/G Foundry Networks ServerIronXL Foundry Networks ServerIron800 Foundry Networks ServerIron400 Foundry Networks ServerIron 7.1 .09 Foundry Networks ServerIron 6.0 Foundry Networks ServerIron 5.1.10 t12 |
| Not Vulnerable: | |
Discussion
Foundry Networks ServerIron Encoded URI Load Balancing Bypass Weakness
The ServerIron family of products from Foundry Networks is a series of high performance internet web switches. Among the included features are several options for load balancing between collections of web servers. Several methods are supported, including the option to perform simple pattern matches on requested URLs.
Reportedly, ServerIron does not fully decode URLs when doing this pattern matching. A malicious HTTP request may bypass all patterns, and be assigned based on default rules. Under some applications, this could lead to the exposure of sensitive information when web servers recieve requests they are not configured to handle.
This is not a vulnerability in the ServerIron product, but may allow an attacker to exploit weakly configured machines behind the switch.
The ServerIron family of products from Foundry Networks is a series of high performance internet web switches. Among the included features are several options for load balancing between collections of web servers. Several methods are supported, including the option to perform simple pattern matches on requested URLs.
Reportedly, ServerIron does not fully decode URLs when doing this pattern matching. A malicious HTTP request may bypass all patterns, and be assigned based on default rules. Under some applications, this could lead to the exposure of sensitive information when web servers recieve requests they are not configured to handle.
This is not a vulnerability in the ServerIron product, but may allow an attacker to exploit weakly configured machines behind the switch.
Solution / Fix
Foundry Networks ServerIron Encoded URI Load Balancing Bypass Weakness
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.