This is exploitable (and tested) against IIS 5/5.1 (IIS6/7 are not vulnerable) However, potentially other web servers are also vulnerable if they are capable of decoding alternate unicode characters. I also agree with you, blaming an IPS for not detecting attack which is impossible in the wild would be very pointless. Although IIS 5 is old, it is still relatively common. Any further questions, feel free to ask. Cheers, Paul Craig Security Consultant Security-Assessment.com -----Original Message----- From: 3APA3A [mailto:3APA3A@xxxxxxxxxxxxxxxx] Sent: Thursday, 12 July 2007 2:30 a.m. To: Paul Craig Cc: bugtraq@xxxxxxxxxxxxxxxxx; full-disclosure@xxxxxxxxxxxxxxxxx Subject: Re: TippingPoint IPS Signature Evasion Dear Paul Craig, --Wednesday, July 11, 2007, 1:37:03 AM, you wrote to bugtraq@xxxxxxxxxxxxxxxxx: PC> http://www.test.com/scripts%c0%afcmd.exe PC> http://www.test.com/scripts%e0%80%afcmd.exe PC> http://www.test.com/scripts%c1%9ccmd.exe PC> Web servers located behind a Tippingpoint IPS device which are capable PC> of decoding alternate Unicode characters can be accessed, and exploited PC> without triggering the IPS device. Can you, please, provide example of such server? Fatih Ozavci reported similar problem with Checkpoint and Halfwidth/Fullwidth Unicode, potential attack vector was IIS with .Net framework, in this case IIS seems not to be exploitable. Blaming IPS it does not detect attack which is impossible in-the-wild is nonsense. Blaming corporate-level IPS doesn't detect attack against SOHO web server is acceptable nonsense :) -- ~/ZARAZA http://securityvulns.com/
