[37316] in bugtraq
Zone Labs IMsecure Active Link Filter Bypass
daemon@ATHENA.MIT.EDU (Kurczaba Associates advisories)
Thu Nov 11 16:30:25 2004
Message-ID: <20041111145844.6b7ac250@mail.kurczaba.com>
From: Kurczaba Associates advisories <advisories@kurczaba.com>
To: bugtraq@securityfocus.com
Date: Thu, 11 Nov 2004 14:58:44 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 8bit
Zone Labs IMsecure Active Link Filter Bypass
http://www.kurczaba.com/html/security/0410141.htm
-------------------------------------------------
Overview:
A vulnerability has been discovered in the Zone Labs IMsecure Active Link Filter
Vendor:
Zone Labs (http://www.zonelabs.com)
Affected Systems/Configuration:
Versions of IMsecure and IMsecure Pro prior to 1.5
Vulnerability/Exploit:
The Active Link filter blocks potentially dangerous URLs in IM messages.
For example, IMsecure will remove URLs with extensions of .vbs, and .exe. By using hex encoded characters in the file extension of the URL, it is possible to bypass the Active Link filter.
Workaround:
Upgrade to version 1.5 or higher
Proof of Concept:
http://www.example.com/somefile.e%78e
In the example above, "78" is hex for "x".In plain English, the URL reads:
http://www.example.com/somefile.exe
Date Discovered:
April 1, 2004
Fix Available:
October 12, 2004
Severity:
Low
Credit:
Paul Kurczaba
Kurczaba Associates
