Zone Labs IMsecure Active Link Filter Bypass
http://www.kurczaba.com/html/security/0410141.htm
-------------------------------------------------
Overview:
A vulnerability has been discovered in the Zone Labs IMsecure Active Link Filter
Vendor:
Zone Labs (http://www.zonelabs.com)
Affected Systems/Configuration:
Versions of IMsecure and IMsecure Pro prior to 1.5
Vulnerability/Exploit:
The Active Link filter blocks potentially dangerous URLs in IM messages.
For example, IMsecure will remove URLs with extensions of .vbs, and .exe. By using hex encoded characters in the file extension of the URL, it is possible to bypass the Active Link filter.
Workaround:
Upgrade to version 1.5 or higher
Proof of Concept:
http://www.example.com/somefile.e%78e
In the example above, "78" is hex for "x".In plain English, the URL reads:
http://www.kurczaba.com/html/security/0410141.htm
-------------------------------------------------
Overview:
A vulnerability has been discovered in the Zone Labs IMsecure Active Link Filter
Vendor:
Zone Labs (http://www.zonelabs.com)
Affected Systems/Configuration:
Versions of IMsecure and IMsecure Pro prior to 1.5
Vulnerability/Exploit:
The Active Link filter blocks potentially dangerous URLs in IM messages.
For example, IMsecure will remove URLs with extensions of .vbs, and .exe. By using hex encoded characters in the file extension of the URL, it is possible to bypass the Active Link filter.
Workaround:
Upgrade to version 1.5 or higher
Proof of Concept:
http://www.example.com/somefile.e%78e
In the example above, "78" is hex for "x".In plain English, the URL reads:
http://www.example.com/somefile.exe
Date Discovered:
April 1, 2004
Fix Available:
October 12, 2004
Severity:
Low
Credit:
Paul Kurczaba
Kurczaba Associates
[ reply ]