|Main Archive Page > Month Archives > full-disclosure-uk archives|
On Mon, 21 May 2007 14:41:58 CDT, Steven Adair said:
> I think you could be on either side, but I would learn towards this being
> a feature than a bug. Multiple products appear to do the decoding in the
> same manner and intentionally perform this function.
No, they merely *claim* to do it the same way.
> However, the recent
> advisories that went out were geared towards IDS/IPS products that were
> not designed to be able to recognize such half-/full-width encoded
And if the IDS doesn't do it the *exact* same way, we're just repeating the mistakes of "using fragmented packets to bypass the IDS", "using X to bypass the IDS", "using Y to bypass the IDS"... and so on.