Ok,
then whats your comment? How can we distinguish the related char set? Or
just look for "\winnt\system...." on an http request...
Regards.
------------------------------------------------------
Ihsan Cakmakli
Y.K.
"Gustavo
Ossandon" To: �HSAN �AKMAKLI/YKB@YKBNOTES,
[EMAIL PROTECTED]
<gossando@adex cc:
us.cl> Subject: Re: valid URLs and Spanish
characters
22.01.2002
15:02
Yeah .... � pthe problem is if you don't use Unicode_Wide_Encoding �any
hacker
or anyone can pass hidden commands or URLs disguised under "%something"...
:-(
G.
|--------------------------------------->
| |
|--------------------------------------->
>---------------------------------------|
| |
>---------------------------------------|
|--------------------------------------->
| To: |
|--------------------------------------->
>---------------------------------------|
| Gustavo Ossandon/ADEXUS@ADEXUS |
>---------------------------------------|
|--------------------------------------->
| cc: |
|--------------------------------------->
>---------------------------------------|
| |
>---------------------------------------|
|--------------------------------------->
| |
|--------------------------------------->
>---------------------------------------|
| |
>---------------------------------------|
|--------------------------------------->
| Subject: |
|--------------------------------------->
>---------------------------------------|
| Re: valid URLs and Spanish |
| characters |
>---------------------------------------|
[IMAGE]
Yes,
Nearly every http request with International chars. So I don't use
Unicode_Wide_encoding.
Regards.
� � � � � � � � � � "Gustavo
� � � � � � � � � �Ossandon" � � � � � �To: � � [EMAIL PROTECTED]
� � � � � � � � � �<gossando@adex � � � cc: � � [EMAIL PROTECTED]
� � � � � � � � � �us.cl> � � � � � � � Subject: � � valid URLs and Spanish
characters
� � � � � � � � � �Sent by:
� � � � � � � � � �owner-issforum
� � � � � � � � � �@iss.net
� � � � � � � � � � 17.01.2002
� � � � � � � � � �14:05
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] �Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
hi guys
we are a big "Global Internet Service Center" and we ahave a lot of clients
under our security systems
One of them is a big local newspaper. As we are spanish spoken people, we
use a
lot of letter with accent and other letes different from standard plain
Ascii.
This Newspaper have the most of their URLs built dinamicaly and some of
them
with words from the pages that have accents �or other spanish caracters.
Most of this URLs are valid and not harmful, but the IDS identifies this as
an
attack or at least an attemp.
Usually
HTTP_IIS_Double_Eval_Evasion
HTTP_IIS_Unicode_Wide_Encoding �( KILL !!! )
HTTP_IIS_Unicode_Encoding �( KILL !!! )
HTTP_IIS_UTF8 �( KILL !!! )
HTTP_IIS_Hex_Evasion �( KILL !!! )
Have anyone see this behavior before ???
Has anyone have any workaround?
The worst of all is Some of this URL with spanish letters are always
stopped and
some of them no ..... �What is exactly the match this Vulnerabilities
does????
Any help will be gladly appreciated !!!
Thanks in advance to all
Gus.
Gustavo Ossandon S.
ADEXUS
[EMAIL PROTECTED]
(Embedded image moved to file: pic21240.pcx)
*** eSafe scanned this email for malicious content ***
*** IMPORTANT: Do not open attachments from unrecognized senders ***
(See attached file: pic21240.pcx)
=?Windows-1254?Q?pic21240.pcx?=
Description: Binary data
