-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                         ESB-2007.0323 -- [Cisco]
          Cisco Security Response: HTTP Full-Width and Half-Width
                         Unicode Encoding Evasion
                                17 May 2007

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Cisco Intrusion Prevention System (IPS)
                      Cisco IOS with Firewall/IPS Feature Set
Publisher:            Cisco Systems
Impact:               Reduced Security
Access:               Remote/Unauthenticated

Original Bulletin:   
  http://www.cisco.com/warp/public/707/cisco-sr-20070514-unicode.shtml
  http://www.kb.cert.org/vuls/id/739224

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Cisco Security Response: 
HTTP Full-Width and Half-Width Unicode Encoding Evasion

http://www.cisco.com/warp/public/707/cisco-sr-20070514-unicode.shtml

Revision 1.0

For Public Release 2007 May 14 2000 UTC (GMT)

- - -----------------------------------------------------------------------

Cisco Response
==============

The U.S. Computer Emergency Response Team (US-CERT) has reported a
network evasion technique using full-width and half-width unicode
characters that affects several Cisco products. The US-CERT advisory is
available at the following link:

http://www.kb.cert.org/vuls/id/739224

By encoding attacks using a full-width or half-width unicode character
set, an attacker can exploit this vulnerability to evade detection by
an Intrusion Prevention System (IPS) or firewall. This may allow the
attacker to covertly scan and attack systems normally protected by an
IPS or firewall.

This response is posted at the following link:

http://www.cisco.com/warp/public/707/cisco-sr-20070514-unicode.shtml

Additional Information
======================

The following Cisco products are affected by this vulnerability (all
versions are affected unless a specific version is explicitly
mentioned):

  * Cisco Intrusion Prevention System (IPS):  Cisco Bug ID CSCsi58602 
  * Cisco IOS with Firewall/IPS Feature Set:  Cisco Bug ID CSCsi67763 

The Cisco PSIRT is not aware of any malicious use of the vulnerability
described in this document.

This issue was reported to Cisco by US-CERT. The original issue was
reported to US-CERT by Fatih Ozavci and Caglar Cakici of Gamasec
Security. Cisco would like to thank US-CERT, Fatih Ozavci and Caglar
Cakici for bringing this issue to our attention.

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT
YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.

Revision History
================

+------------------------------------------------------+
| Revision 1.0 | 2007-May-14 | Initial public release  |
+------------------------------------------------------+

Cisco Security Procedures
=========================

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and registering
to receive security information from Cisco, is available on Cisco's
worldwide website at 
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding Cisco security 
notices. All Cisco security advisories are available at 
http://www.cisco.com/go/psirt.

- - -----------------------------------------------------------------------
All contents are Copyright 2006-2007 Cisco Systems, Inc. All rights
reserved. 
- - -----------------------------------------------------------------------

Updated: May 14, 2007                                Document ID: 91767

- - -----------------------------------------------------------------------
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFGSL+d8NUAbBmDaxQRAihTAKCAOtPHDXhrsIiTUBsDqyjGlD9+9ACgjQFM
ldBr8czr5LIQV+l18bKUYfs=
=6GW2
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRkuTFSh9+71yA2DNAQIyEAQAkXblvxkAcYhLWDRtpXwkhpg0dWC0lnhH
UqDmWyMTtqFy4ySUYAgKCXwIhievinEVNCP1hioUkjvNj1PyfaaLtYHnfoKDdPVF
dW97L7rhfKVUghQwoXGCoNeX+coUA2zaW6jtrg6lbNEYfiW6JoCydwOB3d7DzMgW
BpJZGcR/3aI=
=Iksd
-----END PGP SIGNATURE-----