Finjan SurfinGate File Extension File Filter Circumvention Vulnerability

Bugtraq ID:	6703
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 27 2003 12:00AM
Updated:	Jan 27 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Compass Security.
Vulnerable:	Finjan Software SurfinGate 6.0 5 Finjan Software SurfinGate 6.0 1 Finjan Software SurfinGate 6.0 Finjan Software SurfinGate 5.6
Not Vulnerable:	Finjan Software SurfinGate 7.0

Finjan SurfinGate File Extension File Filter Circumvention Vulnerability

A problem with SurfinGate could make it possible for an attacker to circumvent file filters that are set in place.

SurfinGate uses the file extension to determine if a file is of a type that is blacklisted by the software. It has been reported that an attacker may bypass SurfinGate file filtering rules by appending an extra file extension of a type that is not blacklisted to the end of the file name.

It should be noted that an end user would still have interactively to open or execute the malicious file.

Finjan SurfinGate File Extension File Filter Circumvention Vulnerability

There is no exploit required.

Finjan SurfinGate File Extension File Filter Circumvention Vulnerability

Solution:
The vendor has addressed this issue in SurfinGate 7.0. Users are advised to upgrade.

Finjan SurfinGate File Extension File Filter Circumvention Vulnerability

References:

• SurfinGate Product Page (Finjan Software)
  
• RE: Tech Article: HTTP Content Filter Analysis - Finjan SurfinGate V5.6 ("Menashe Eliezer" )
  
• Tech Article: HTTP Content Filter Analysis - Finjan SurfinGate v5.6 ("[email protected]" )