full-disclosure-uk May 2007 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] noise about full-width

Re: [Full-disclosure] noise about full-width encoding bypass?

From: <Valdis.Kletnieks_at_nospam>
Date: Mon May 21 2007 - 20:06:06 GMT
To: steven@securityzone.org


On Mon, 21 May 2007 14:41:58 CDT, Steven Adair said:
> I think you could be on either side, but I would learn towards this being
> a feature than a bug. Multiple products appear to do the decoding in the
> same manner and intentionally perform this function.

No, they merely *claim* to do it the same way.

> However, the recent
> advisories that went out were geared towards IDS/IPS products that were
> not designed to be able to recognize such half-/full-width encoded
> traffic.

And if the IDS doesn't do it the *exact* same way, we're just repeating the mistakes of "using fragmented packets to bypass the IDS", "using X to bypass the IDS", "using Y to bypass the IDS"... and so on.



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/