Critical Unicode Flaw Undercuts Firewalls, Scanners
Updated: US-CERT reports that 92 security products by different vendors, including Cisco, may have a serious security hole. Given these products' market share, most businesses could be affected.The U.S. Computer Emergency Response Team is reporting a network evasion technique that uses full-width and half-width unicode characters to allow malware to evade detection by an IPS or firewall. The vulnerability affects virtually every major firewall and intrusion prevention system available, including products from Cisco Systems. Given Ciscos major share of the market, at least for enterprise routers and VPN and firewall equipmentaccording to Gartner, Cisco was at the top of the heap with 66 percent of that market in 2006that means most businesses will be affected. The vulnerability concerns HTTP content-scanning systems that fail to properly scan full-width and half-width Unicode-encoded HTTP traffic. A remote attacker could exploit the vulnerability by sending specially crafted HTTP traffic to a vulnerable content scanning system. After sneaking malware past the firewall or IPS, the attacker can then wreak havoc on a system, scanning and attacking without being detected.
Multiple Cisco products are affected, including Ciscos IPS CSCsi58602 and its Cisco IOS with Firewall/IPS Feature Set CSCsi67763. Cisco has an advisory up. In the advisory the company states that its not aware of any exploits of the vulnerability.