Critical Unicode Flaw Undercuts Firewalls, Scanners

By Lisa Vaas  |  Posted 2007-05-15 Print this article Print

Updated: US-CERT reports that 92 security products by different vendors, including Cisco, may have a serious security hole. Given these products' market share, most businesses could be affected.

The U.S. Computer Emergency Response Team is reporting a network evasion technique that uses full-width and half-width unicode characters to allow malware to evade detection by an IPS or firewall. The vulnerability affects virtually every major firewall and intrusion prevention system available, including products from Cisco Systems. Given Ciscos major share of the market, at least for enterprise routers and VPN and firewall equipment—according to Gartner, Cisco was at the top of the heap with 66 percent of that market in 2006—that means most businesses will be affected. The vulnerability concerns HTTP content-scanning systems that fail to properly scan full-width and half-width Unicode-encoded HTTP traffic. A remote attacker could exploit the vulnerability by sending specially crafted HTTP traffic to a vulnerable content scanning system. After sneaking malware past the firewall or IPS, the attacker can then wreak havoc on a system, scanning and attacking without being detected.
Multiple Cisco products are affected, including Ciscos IPS CSCsi58602 and its Cisco IOS with Firewall/IPS Feature Set CSCsi67763. Cisco has an advisory up. In the advisory the company states that its not aware of any exploits of the vulnerability.
For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub. While Cisco is the only vendor to have verified that its products are vulnerable, theres a long list of vendors that havent said whether their products are vulnerable or not. A security vendor says an IOS FTP Server backdoor reported by Cisco may have been planted rather than accidental. Click here to read more. Specifically, the US-CERT note lists 92 vendors whose security products may be vulnerable; of those, as of the afternoon of May 15, only two—Apple and Hewlett-Packard—had verified that their security software isnt vulnerable. The list of other companies products whose vulnerability status is unknown ranges widely, from products by 3Com and F5 Networks to the open-source Snort and just about every other well-known security product out there. The vulnerability has been known since at least April 16 and was made public on May 14. Editors Note: This story was updated to include additional information about the flaws relevance to enterprise security. Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.
Lisa Vaas is News Editor/Operations for and also serves as editor of the Database topic center. Since 1995, she has also been a Webcast news show anchorperson and a reporter covering the IT industry. She has focused on customer relationship management technology, IT salaries and careers, effects of the H1-B visa on the technology workforce, wireless technology, security, and, most recently, databases and the technologies that touch upon them. Her articles have appeared in eWEEK's print edition, on, and in the startup IT magazine PC Connection. Prior to becoming a journalist, Vaas experienced an array of eye-opening careers, including driving a cab in Boston, photographing cranky babies in shopping malls, selling cameras, typography and computer training. She stopped a hair short of finishing an M.A. in English at the University of Massachusetts in Boston. She earned a B.S. in Communications from Emerson College. She runs two open-mic reading series in Boston and currently keeps bees in her home in Mashpee, Mass.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel