full-disclosure-uk May 2007 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] noise about full-width

Re: [Full-disclosure] noise about full-width encoding bypass?

From: Brian Eaton <eaton.lists_at_nospam>
Date: Mon May 21 2007 - 15:33:08 GMT
To: "Łukasz Pilorz" <lukasz@pilorz.net>


On 5/21/07, Łukasz Pilorz <lukasz@pilorz.net> wrote:
> I think this encoding bypass may have some impact on applications
> which convert data from Unicode/UTF to other encodings. A naive
> example:
> http://lukasz.pilorz.net/testy/full_width_utf/index.phps
>
> But I don't suggest this was the main problem, I have probably missed
> something too.

Your POC works for me, the PHP iconv code converts the UTF-8 byte sequence 0xef 0xbc 0x9C to ASCII '<'. Looks like PHP applications may be at risk.

The java CharsetDecoder class does not. (I don't think this will be JRE specific, but I tested the IBM JRE...).

The perl Encode module does not.

Anybody have an IIS server handy, to test out how .NET handles this?

Regards,
Brian



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/