SpearHead Security
----------------------------------------------------------------------
Subject : URL encoding
Advisory number : 06-01-0001
Issue date : 6-5-2001
Impact: NetGAP 200 and 300 devices configured as internet gateways
Background
SpearHead's NetGAP is a security device which allows secure data transfer
between disconnected networks.
The NetGAP consists of two separated CPU's, each connected to a different
physical network and a unique hardware mechanism that transfers data between
them.
The NetGAP has two major implementations :
1. Back-office server farm protection.
2. Secure company internet access gateway.
Problem description:
There was a problem in the HTTP protocol parsing mechanism that caused it to
fail when checking "%" encoded URL's, passing them to the requesting user
without content inspection (NetGAP 300 only) or file type blocking (NetGAP
200 and 300).
The problem only effects machines running as an internet gateway since
server protected data is usually not checked leaving the network.
Solution:
The problem was fixed in build 78 of the NetGAP software.
Acknowledgement:
eDvice Security Services
