SurfControl SuperScout Web Filter does not block some HTTP requests that have been fragmented into multiple packets.
SurfControl SuperScout Web Filter is software intended for companies that wish to limit employees' web surfing to appropriate uses. SuperScout anazlyzes individual packets that contain an HTTP GET request and a "Host:" header to determine whether an HTTP request to an inappropriate Web site is being made. SuperScout does not keep state of previous packets. Therefore, it will not block HTTP GET requests if the "Host:" header appears in a separate packet.
Users can bypass SuperScout filtering and access blocked Web content.
The CERT/CC is currently unaware of a practical solution to this problem.
Thanks to Security Tracker for publishing an article on this issue.
This document was written by Shawn Van Ittersum.
|Date First Published:||2002-08-09|
|Date Last Updated:||2002-08-09 00:30 UTC|