PT-2003-1370 · Symantec · Symantec Enterprise Firewall

Martin Oneal · Publicado 2003-03-27 · Atualizado 2016-10-18 · CVE-2003-0106

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Enterprise Firewall (SEF) version 7.0

Description The issue concerns the HTTP proxy component, which fails to properly apply pattern matching rules for blocked URLs when requests utilize URL encoding with escapes, Unicode, or UTF-8. This allows proxy users to bypass restrictions.

Recommendations For Symantec Enterprise Firewall (SEF) version 7.0, consider disabling the HTTP proxy feature until a fix is available to prevent users from bypassing URL restrictions.

Correção

Identificadores relacionados

CVE-2003-0106

Produtos afetados

Symantec Enterprise Firewall

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2003-0106 · Nota de Segurança
• http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2003032507434754 · Aviso do Fabricante
• http://marc.info/?l=ntbugtraq&m=104868285106289&w=2 · Nota
• http://securityfocus.com/bid/7196 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=104869513822233&w=2 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0152.html · Nota