Signature Detail

HTTP: Half-Full Width Unicode Encoding and Double Encoding Bypass

This signatures detects unicode encoding in HTTP requests. Some IPS do not decode unicode in HTTP requests properly. An attacker can attempt to evade the IPS by using such encoding.

Extended Description

Multiple products are reportedly prone to a vulnerability that may allow malicious HTTP traffic to bypass detection. Attackers may send this type of HTTP data to evade detection and perform further attacks. Cisco has stated that all IOS releases that support the Firewall/IPS feature set are affected. Although we currently have no definitive list of such versions, Symantec is investigating the matter and will update this BID's list of vulnerable systems appropriately.

Affected Products

• Cisco Intrusion Prevention System 4.X
• Cisco Intrusion Prevention System 5.0.0 (1)
• Cisco Intrusion Prevention System 5.0.0 (2)
• Cisco Intrusion Prevention System 5.0.0 (3)
• Cisco Intrusion Prevention System 5.0(6P1)
• Cisco Intrusion Prevention System 5.0(6p2)
• Cisco Intrusion Prevention System 5.1(1)
• Cisco Intrusion Prevention System 5.1(1B)
• Cisco Intrusion Prevention System 5.1(1C)
• Cisco Intrusion Prevention System 5.1(1D)
• Cisco Intrusion Prevention System 5.1(1E)
• Cisco Intrusion Prevention System 5.1(2)
• Cisco Intrusion Prevention System 5.1(P1)
• Cisco Intrustion Prevention software 5.1(1A)
• Cisco IOS 12.3
• Cisco IOS 12.3.0 -7-JA2
• Cisco IOS 12.3(10)
• Cisco IOS 12.3(10)A
• Cisco IOS 12.3(10C)
• Cisco IOS 12.3(10D)
• Cisco IOS 12.3(10E)
• Cisco IOS 12.3(10)T
• Cisco IOS 12.3(11)
• Cisco IOS 12.3(11R)T2
• Cisco IOS 12.3(11)T
• Cisco IOS 12.3(11)T10
• Cisco IOS 12.3(11)T2
• Cisco IOS 12.3(11)T4
• Cisco IOS 12.3(11)T5
• Cisco IOS 12.3(11)T6
• Cisco IOS 12.3(11)T8
• Cisco IOS 12.3(11)XL
• Cisco IOS 12.3(11)XL3
• Cisco IOS 12.3(11)YF
• Cisco IOS 12.3(11)YF2
• Cisco IOS 12.3(11)YF3
• Cisco IOS 12.3(11)YF4
• Cisco IOS 12.3(11)YJ
• Cisco IOS 12.3(11)YK
• Cisco IOS 12.3(11)YK1
• Cisco IOS 12.3(11)YK2
• Cisco IOS 12.3(11)YL
• Cisco IOS 12.3(11)YN
• Cisco IOS 12.3(11)YR
• Cisco IOS 12.3(11)YS
• Cisco IOS 12.3(11)YS1
• Cisco IOS 12.3(11)YW
• Cisco IOS 12.3(11)YZ1
• Cisco IOS 12.3(12)
• Cisco IOS 12.3(12A)
• Cisco IOS 12.3(12B)
• Cisco IOS 12.3(12D)
• Cisco IOS 12.3(12E)
• Cisco IOS 12.3(12)T
• Cisco IOS 12.3(13)
• Cisco IOS 12.3(13A)
• Cisco IOS 12.3(13A)BC
• Cisco IOS 12.3(13A)BC1
• Cisco IOS 12.3(13B)
• Cisco IOS 12.3(13)T
• Cisco IOS 12.3(14)T
• Cisco IOS 12.3(14)T2
• Cisco IOS 12.3(14)T4
• Cisco IOS 12.3(14)T5
• Cisco IOS 12.3(14)T7
• Cisco IOS 12.3(14)T8
• Cisco IOS 12.3(14)T9
• Cisco IOS 12.3(14)YG5
• Cisco IOS 12.3(14)YM4
• Cisco IOS 12.3(14)YM8
• Cisco IOS 12.3(14)YQ
• Cisco IOS 12.3(14)YQ1
• Cisco IOS 12.3(14)YQ3
• Cisco IOS 12.3(14)YQ4
• Cisco IOS 12.3(14)YQ8
• Cisco IOS 12.3(14)YT
• Cisco IOS 12.3(14)YT1
• Cisco IOS 12.3(14)YU
• Cisco IOS 12.3(14)YU1
• Cisco IOS 12.3(14)YX
• Cisco IOS 12.3(14)YX2
• Cisco IOS 12.3(15)
• Cisco IOS 12.3(15A)
• Cisco IOS 12.3(15B)
• Cisco IOS 12.3(16)
• Cisco IOS 12.3(17B)BC3
• Cisco IOS 12.3(18)
• Cisco IOS 12.3(1A)
• Cisco IOS 12.3(1)T
• Cisco IOS 12.3(20)
• Cisco IOS 12.3(21)
• Cisco IOS 12.3(2)JA
• Cisco IOS 12.3(2)JA5
• Cisco IOS 12.3(2)JK
• Cisco IOS 12.3(2)JK1
• Cisco IOS 12.3(2)JL
• Cisco IOS 12.3(2)T
• Cisco IOS 12.3(2)T3
• Cisco IOS 12.3(2)T8
• Cisco IOS 12.3(2)XA4
• Cisco IOS 12.3(2)XA5
• Cisco IOS 12.3(2)XC1
• Cisco IOS 12.3(2)XC2
• Cisco IOS 12.3(2)XC3
• Cisco IOS 12.3(2)XC4
• Cisco IOS 12.3(2)XE3
• Cisco IOS 12.3(2)XE4
• Cisco IOS 12.3(3A)
• Cisco IOS 12.3(3E)
• Cisco IOS 12.3(3H)
• Cisco IOS 12.3(3I)
• Cisco IOS 12.3(3)T
• Cisco IOS 12.3(4)EO1
• Cisco IOS 12.3(4)JA
• Cisco IOS 12.3(4)JA1
• Cisco IOS 12.3(4)T
• Cisco IOS 12.3(4)T1
• Cisco IOS 12.3(4)T13
• Cisco IOS 12.3(4)T2
• Cisco IOS 12.3(4)T3
• Cisco IOS 12.3(4)T4
• Cisco IOS 12.3(4)T8
• Cisco IOS 12.3(4)Tpc11a
• Cisco IOS 12.3(4)XD
• Cisco IOS 12.3(4)XD1
• Cisco IOS 12.3(4)XD2
• Cisco IOS 12.3(4)XE4
• Cisco IOS 12.3(4)XG1
• Cisco IOS 12.3(4)XG2
• Cisco IOS 12.3(4)XG4
• Cisco IOS 12.3(4)XG5
• Cisco IOS 12.3(4)XH
• Cisco IOS 12.3(4)XK
• Cisco IOS 12.3(4)XK1
• Cisco IOS 12.3(4)XK3
• Cisco IOS 12.3(4)XK4
• Cisco IOS 12.3(4)XQ
• Cisco IOS 12.3(4)XQ1
• Cisco IOS 12.3(5)
• Cisco IOS 12.3(5A)
• Cisco IOS 12.3(5A)B
• Cisco IOS 12.3(5A)B2
• Cisco IOS 12.3(5A)B5
• Cisco IOS 12.3(5B)
• Cisco IOS 12.3(5)B1
• Cisco IOS 12.3(5C)
• Cisco IOS 12.3(5E)
• Cisco IOS 12.3(5F)
• Cisco IOS 12.3(5)T
• Cisco IOS 12.3(6)
• Cisco IOS 12.3(6A)
• Cisco IOS 12.3(6D)
• Cisco IOS 12.3(6E)
• Cisco IOS 12.3(6F)
• Cisco IOS 12.3(6)T
• Cisco IOS 12.3(7.7)
• Cisco IOS 12.3(7)JA
• Cisco IOS 12.3(7)JA1
• Cisco IOS 12.3(7)JX
• Cisco IOS 12.3(7)T
• Cisco IOS 12.3(7)T10
• Cisco IOS 12.3(7)T11
• Cisco IOS 12.3(7)T12
• Cisco IOS 12.3(7)T4
• Cisco IOS 12.3(7)T8
• Cisco IOS 12.3(7)T9
• Cisco IOS 12.3(7)XI3
• Cisco IOS 12.3(7)XI4
• Cisco IOS 12.3(7)XI7
• Cisco IOS 12.3(7)Xi8a
• Cisco IOS 12.3(7)XI9
• Cisco IOS 12.3(7)XR3
• Cisco IOS 12.3(7)XR4
• Cisco IOS 12.3(7)XR6
• Cisco IOS 12.3(8)JA
• Cisco IOS 12.3(8)JA1
• Cisco IOS 12.3(8)JK
• Cisco IOS 12.3(8)T
• Cisco IOS 12.3(8)T10
• Cisco IOS 12.3(8)T11
• Cisco IOS 12.3(8)T4
• Cisco IOS 12.3(8)T7
• Cisco IOS 12.3(8)T8
• Cisco IOS 12.3(8)T9
• Cisco IOS 12.3(8)XU2
• Cisco IOS 12.3(8)XY4
• Cisco IOS 12.3(8)XY5
• Cisco IOS 12.3(8)XY6
• Cisco IOS 12.3(8)YA1
• Cisco IOS 12.3(8)YD
• Cisco IOS 12.3(8)YF
• Cisco IOS 12.3(8)YG
• Cisco IOS 12.3(8)YG1
• Cisco IOS 12.3(8)YG2
• Cisco IOS 12.3(8)YG3
• Cisco IOS 12.3(8)YG5
• Cisco IOS 12.3(8)YH
• Cisco IOS 12.3(8)YI
• Cisco IOS 12.3(8)YI1
• Cisco IOS 12.3(8)YI3
• Cisco IOS 12.3(9)
• Cisco IOS 12.3(9A)BC
• Cisco IOS 12.3(9A)BC2
• Cisco IOS 12.3(9A)BC6
• Cisco IOS 12.3(9A)BC7
• Cisco IOS 12.3(9B)
• Cisco IOS 12.3(9C)
• Cisco IOS 12.3(9D)
• Cisco IOS 12.3(9E)
• Cisco IOS 12.3(9)T
• Cisco IOS 12.3B
• Cisco IOS 12.3BC
• Cisco IOS 12.3BW
• Cisco IOS 12.3JA
• Cisco IOS 12.3JEA
• Cisco IOS 12.3JEB
• Cisco IOS 12.3JK
• Cisco IOS 12.3JL
• Cisco IOS 12.3JX
• Cisco IOS 12.3T
• Cisco IOS 12.3TPC
• Cisco IOS 12.3XA
• Cisco IOS 12.3XB
• Cisco IOS 12.3XC
• Cisco IOS 12.3XD
• Cisco IOS 12.3XE
• Cisco IOS 12.3XF
• Cisco IOS 12.3XG
• Cisco IOS 12.3XH
• Cisco IOS 12.3XI
• Cisco IOS 12.3XJ
• Cisco IOS 12.3XK
• Cisco IOS 12.3XL
• Cisco IOS 12.3XM
• Cisco IOS 12.3XN
• Cisco IOS 12.3XQ
• Cisco IOS 12.3XR
• Cisco IOS 12.3XS
• Cisco IOS 12.3XT
• Cisco IOS 12.3XU
• Cisco IOS 12.3XV
• Cisco IOS 12.3XW
• Cisco IOS 12.3XX
• Cisco IOS 12.3XY
• Cisco IOS 12.3XZ
• Cisco IOS 12.3YA
• Cisco IOS 12.3YB
• Cisco IOS 12.3YC
• Cisco IOS 12.3YD
• Cisco IOS 12.3YE
• Cisco IOS 12.3YF
• Cisco IOS 12.3YG
• Cisco IOS 12.3YH
• Cisco IOS 12.3YI
• Cisco IOS 12.3YJ
• Cisco IOS 12.3YK
• Cisco IOS 12.3YL
• Cisco IOS 12.3YM
• Cisco IOS 12.3YN
• Cisco IOS 12.3YQ
• Cisco IOS 12.3YR
• Cisco IOS 12.3YS
• Cisco IOS 12.3YT
• Cisco IOS 12.3YU
• Cisco IOS 12.3YW
• Cisco IOS 12.3YX
• Cisco IOS 12.3YZ
• Cisco IOS 12.4
• Cisco IOS 12.4(1)
• Cisco IOS 12.4(11)T
• Cisco IOS 12.4(12)
• Cisco IOS 12.4(1B)
• Cisco IOS 12.4(1C)
• Cisco IOS 12.4(2)MR
• Cisco IOS 12.4(2)MR1
• Cisco IOS 12.4(2)T
• Cisco IOS 12.4(2)T1
• Cisco IOS 12.4(2)T2
• Cisco IOS 12.4(2)T3
• Cisco IOS 12.4(2)T4
• Cisco IOS 12.4(2)XA
• Cisco IOS 12.4(2)XB
• Cisco IOS 12.4(2)XB2
• Cisco IOS 12.4(3)
• Cisco IOS 12.4(3A)
• Cisco IOS 12.4(3B)
• Cisco IOS 12.4(3D)
• Cisco IOS 12.4(3)T2
• Cisco IOS 12.4(4)MR
• Cisco IOS 12.4(4)T
• Cisco IOS 12.4(4)T2
• Cisco IOS 12.4(5)
• Cisco IOS 12.4(5B)
• Cisco IOS 12.4(6)T
• Cisco IOS 12.4(6)T1
• Cisco IOS 12.4(6)T6
• Cisco IOS 12.4(7)
• Cisco IOS 12.4(7A)
• Cisco IOS 12.4(8)
• Cisco IOS 12.4(9)T
• Cisco IOS 12.4MR
• Cisco IOS 12.4SW
• Cisco IOS 12.4T
• Cisco IOS 12.4XA
• Cisco IOS 12.4XB
• Cisco IOS 12.4XC
• Cisco IOS 12.4XD
• Cisco IOS 12.4XE
• Cisco IOS 12.4XG
• Cisco IOS 12.4XJ
• Cisco IOS 12.4XP
• Cisco IOS 12.4XT
• Cisco PIX 500 Series Security Appliance 7.0
• Cisco PIX 500 Series Security Appliance 7.1
• Cisco PIX/ASA 7.0.0
• Cisco PIX/ASA 7.0.1 .4
• Cisco PIX/ASA 7.0.4
• Cisco PIX/ASA 7.0.4 .3
• Cisco PIX/ASA 7.0(5)
• Cisco PIX/ASA 7.0(5.2)
• Cisco PIX/ASA 7.1(2)
• Cisco PIX/ASA 7.1.(2.48)
• Cisco PIX/ASA 7.1.(2.49)
• Cisco PIX/ASA 7.1(2.5)
• Cisco PIX/ASA 7.2(1)
• Cisco PIX/ASA 7.2.2
• Cisco PIX/ASA 7.2(2.10)
• Cisco PIX/ASA 7.2(2.14)
• Cisco PIX/ASA 7.2(2.15)
• Cisco PIX/ASA 7.2.(2.16)
• Cisco PIX/ASA 7.2.(2.17)
• Cisco PIX/ASA 7.2.(2.19)
• Cisco PIX/ASA 7.2.(2.7)
• Cisco PIX/ASA 7.2.(2.8)
• Stonesoft StoneGate IPS Sensor and Analyzer 2.0.0
• Stonesoft StoneGate IPS Sensor and Analyzer 2.0.1
• Stonesoft StoneGate IPS Sensor and Analyzer 2.0.2
• TippingPoint 1200E
• TippingPoint 200
• TippingPoint 200E
• TippingPoint 2400E
• TippingPoint 50
• TippingPoint 5000E
• TippingPoint 600E
• TippingPoint SMS
• TippingPoint X505
• TippingPoint X506
• TippingPoint ZPHA

References

• BugTraq: 23980
• CVE: CVE-2007-2689
• URL: http://www.gamasec.net/english/gs07-01.html
• URL: http://www.kb.cert.org/vuls/id/739224
• URL: http://isc.sans.org/diary.html?storyid=2807