PT-2007-4005 · Cisco · Cisco Intrusion Prevention System+1

Published 2007-05-16 · Updated 2018-10-30 · CVE-2007-2688

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Intrusion Prevention System (IPS) (affected versions not specified) Cisco IOS with Firewall/IPS Feature Set (affected versions not specified)

Description The issue is related to the improper handling of certain full-width and half-width Unicode character encodings in HTTP traffic. This could potentially allow remote attackers to evade detection.

Recommendations For Cisco Intrusion Prevention System (IPS), update the system to properly handle Unicode character encodings. For Cisco IOS with Firewall/IPS Feature Set, update the feature set to correctly process Unicode characters in HTTP traffic. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-2688

Affected Products

Cisco Ios

Cisco Intrusion Prevention System

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2007-2688 · Security Note
• http://cisco.com/en/US/products/products_security_response09186a008083f82e.html · Vendor Advisory
• http://secunia.com/advisories/25285 · Vendor Advisory
• http://securityfocus.com/bid/23980 · Note
• http://vupen.com/english/advisories/2007/1803 · Note
• http://securityfocus.com/archive/1/468633/100/0/threaded · Note
• http://securitytracker.com/id?1018054 · Note
• http://gamasec.net/english/gs07-01.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34277 · Note
• http://osvdb.org/35336 · Note
• http://securitytracker.com/id?1018053 · Note
• http://kb.cert.org/vuls/id/739224 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5465 · Note