TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
hi Gustavo and everybody. My Organization is placed in Spain and we have got a lot of this signatures in our RS, and allmost all of them are false positives because of the "�", "�",�.... We were thinking in filter all this signatures in the Policies editor, but this is a hard work, and nowadays we are looking at all this events (one to one). Wen eed help too about this signatures and how can reduce all of the false positives with a normal (not sofisticated) way. Thanksin advance. Raul Ceferino Gil DGGC (Direccion General de la Guardia Civil) C/ Guzman el Bueno 110, Madrid, Spain, 28003 Phone: +34 915146000 (ext. 8603) ----- Original Message ----- From: "Gustavo Ossandon" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Thursday, January 17, 2002 12:35 PM Subject: valid URLs and Spanish characters > > TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to > [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! > -------------------------------------------------------------------------- -- > > hi guys > > > we are a big "Global Internet Service Center" and we ahave a lot of clients > under our security systems > > One of them is a big local newspaper. As we are spanish spoken people, we use a > lot of letter with accent and other letes different from standard plain Ascii. > This Newspaper have the most of their URLs built dinamicaly and some of them > with words from the pages that have accents or other spanish caracters. > > Most of this URLs are valid and not harmful, but the IDS identifies this as an > attack or at least an attemp. > > Usually > HTTP_IIS_Double_Eval_Evasion > HTTP_IIS_Unicode_Wide_Encoding ( KILL !!! ) > HTTP_IIS_Unicode_Encoding ( KILL !!! ) > HTTP_IIS_UTF8 ( KILL !!! ) > HTTP_IIS_Hex_Evasion ( KILL !!! ) > > Have anyone see this behavior before ??? > Has anyone have any workaround? > The worst of all is Some of this URL with spanish letters are always stopped and > some of them no ..... What is exactly the match this Vulnerabilities does???? > > Any help will be gladly appreciated !!! > > Thanks in advance to all > > Gus. > > > Gustavo Ossandon S. > ADEXUS > [EMAIL PROTECTED] > > >
