Finjan SurfinGate Unknown File Extension File Filter Circumvention Vulnerability
BID:6707
Info
Finjan SurfinGate Unknown File Extension File Filter Circumvention Vulnerability
| Bugtraq ID: | 6707 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 28 2003 12:00AM |
| Updated: | Jan 28 2003 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Compass Security. |
| Vulnerable: |
Finjan Software SurfinGate 6.0 5 Finjan Software SurfinGate 6.0 1 Finjan Software SurfinGate 6.0 Finjan Software SurfinGate 5.6 |
| Not Vulnerable: |
Finjan Software SurfinGate 7.0 |
Discussion
Finjan SurfinGate Unknown File Extension File Filter Circumvention Vulnerability
A problem with SurfinGate could make it possible for an attacker to circumvent file filters that are set in place.
SurfinGate uses the file extension to determine if a file is of a type that is blacklisted by the software. It has been reported that an attacker may bypass SurfinGate file filtering rules using a file extension that is not recognized by the filtering software.
It should be noted that an end user would still have interactively to open or execute the malicious file. This may be suspicious if there is no handler on the local system for the unknown file extension.
SurfinGate 7.0 is reported to also use the MIME type to detect file types. This may detect some malicious files with unknown file extensions.
A problem with SurfinGate could make it possible for an attacker to circumvent file filters that are set in place.
SurfinGate uses the file extension to determine if a file is of a type that is blacklisted by the software. It has been reported that an attacker may bypass SurfinGate file filtering rules using a file extension that is not recognized by the filtering software.
It should be noted that an end user would still have interactively to open or execute the malicious file. This may be suspicious if there is no handler on the local system for the unknown file extension.
SurfinGate 7.0 is reported to also use the MIME type to detect file types. This may detect some malicious files with unknown file extensions.
Exploit / POC
Finjan SurfinGate Unknown File Extension File Filter Circumvention Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
Finjan SurfinGate Unknown File Extension File Filter Circumvention Vulnerability
Solution:
This issue has been partially addressed in SurfinGate 7.0, which will try to determine file type by the MIME type. A more complete solution is planned for a future release.
Solution:
This issue has been partially addressed in SurfinGate 7.0, which will try to determine file type by the MIME type. A more complete solution is planned for a future release.
References
Finjan SurfinGate Unknown File Extension File Filter Circumvention Vulnerability
References:
References:
- SurfinGate Product Page (Finjan Software)
- RE: Tech Article: HTTP Content Filter Analysis - Finjan SurfinGate V5.6 ("Menashe Eliezer"
- Tech Article: HTTP Content Filter Analysis - Finjan SurfinGate v5.6 ("[email protected]"