Symantec Enterprise Firewall HTTP Pattern Matching Evasion Weakness

Bugtraq ID:	7196
Class:	Design Error
CVE:	CVE-2003-0106
Remote:	Yes
Local:	No
Published:	Mar 26 2003 12:00AM
Updated:	Jul 11 2009 09:06PM
Credit:	Discovery is credited to Martin O'Neal <[email protected]>.
Vulnerable:	Symantec Enterprise Firewall 7.0 Solaris - Sun Solaris 7.0 - Sun Solaris 2.6 Symantec Enterprise Firewall 7.0 NT/2000 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0
Not Vulnerable:

Symantec Enterprise Firewall HTTP Pattern Matching Evasion Weakness

Symantec Enterprise Firewall allows HTTP requests containing certain patterns to be blocked. When a URL containing a pattern that matches a pattern blocking rule is submitted by a user behind the firewall, that HTTP request will be blocked. If the same URL is encoded using escaped character sequences, Unicode, or UTF-8, the HTTP request will not be blocked.

Symantec Enterprise Firewall HTTP Pattern Matching Evasion Weakness

There is no exploit code required.

Symantec Enterprise Firewall HTTP Pattern Matching Evasion Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Symantec Enterprise Firewall HTTP Pattern Matching Evasion Weakness

References:

• How to protect against directory traversal and URL overflow attacks (Symantec)
  
• Symantec Enterprise Firewall (SEF) HTTP URL pattern evasion issue (Corsaire)
  
• Symantec Enterprise Firewall Product Homepage (Symantec)