March 26, 2003 - Corsaire, www.corsaire.com, an independent information security consultancy, have discovered an issue with the way Symantec Enterprise Firewall [1] handles URL encoding techniques causing pattern correlation evasion and in certain instances attacks to transpire.

The Symantec Enterprise Firewall uses an application proxy strategy to provide enhanced security features for a variety of common protocols. For the HTTP proxy, part of this additional functionality allows the firewall to block URLs based on predefined regular expression patterns. However, by using URL encoding techniques this pattern matching functionality can easily be evaded.

The HTTP pattern matching functionality works by analysing the HTTP URL format and comparing these against a database of predefined signatures. When an HTTP connection is passed via a rule that is configured to use the pattern matching functionality, it is checked against the signature database and if a match is found, the request is blocked with a 403 Forbidden error.

Martin O'Neal, Technical Director at Corsaire warns, " if one of the standard URL encoding techniques (e.g. escaped encoding, Unicode, UTF-8) is used then the pattern matching will fail to trigger, and the attack will succeed. Consequentially, we notified our client base (without exposing any of the details) and passed a full advisory onto Symantec for resolution."

To minimize the risks associated with URL buffer overflow techniques, Symantec have recommended that web servers be regularly patched in accordance with the vendor's latest specifications. Further information is available at http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2003032507434754

References
[1] www.symantec.com

About Corsaire
With over 6 years experience in providing network security solutions to the private, public and non-profit sectors, including the FTSE 100, Corsaire is considered the UK's leading specialist in the delivery of information security design, implementation and management. Whilst offering a broad range of bespoke solutions that are based on industry standards & guidelines, Corsaire adopt a consultative approach and combine a vendor neutral policy with knowledge-share to deliver impartial, up-to-date, personable advice. Corsaire is respected for its contribution to R&D, its consistent, high-level service delivery and an ability to combine technical and commercial excellence within the workplace.