search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Multiple vendors' HTTP content/virus scanners do not check data tunneled via HTTP CONNECT method

Vulnerability Note VU#868219

Original Release Date: 2002-10-15 | Last Revised: 2002-10-16

Overview

Multiple vendors' HTTP anti-virus and content filters do not inspect the contents of HTTP CONNECT method tunnels. As a result, viruses or other restricted HTTP content may not be blocked as specified by policy.

Description

Many anti-virus and content filter products that are designed to inspect HTTP application data rely on HTTP proxy functionality to examine the contents of HTTP connections. In turn, HTTP proxy services commonly support the HTTP CONNECT method, which is designed to create a TCP connection that bypasses the normal application layer functionality of the proxy. Typically, the HTTP CONNECT method is used to tunnel HTTPS connections through an HTTP proxy. The application layer data in an HTTP CONNECT method tunnel is opaque to the proxy service. The default configurations of many HTTP proxy services allow arbitrary TCP connections to be made using the HTTP CONNECT method [VU#150227].

As most HTTP proxy services ignore the HTTP data contained within an HTTP CONNECT method tunnel, so do most HTTP anti-virus and content scanners. As a result, it may be possible to create an HTTP CONNECT method tunnel through a vulnerable HTTP anti-virus or content scanner and transfer viruses or other restricted HTTP content.

Impact

A malicious actor may be able to bypass HTTP anti-virus software and HTTP content restrictions by transferring data via an HTTP CONNECT method tunnel.

Solution


Upgrade or Patch

Upgrade or apply a patch as specified by your vendor.


Architect HTTP Content Inspection

Depending on the behavior of different HTTP proxy and HTTP anti-virus/content inspection products, it may be possible to design a system that is able to inspect data that has passed through an HTTP CONNECT method tunnel.

Examine Tunneled Data

If possible, configure your HTTP anti-virus/content filters to examine the application layer contents of HTTP CONNECT method tunnels.

Use Desktop Anti-Virus Software

Deploy and maintain updated anti-virus software on client systems.

Vendor Information

868219
Expand all

Trend Micro

Updated:  April 15, 2002

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC tested InterScan VirusWall 3.52 on Windows 2000 and found it to be vulnerable.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

F-Secure

Notified:  April 19, 2002 Updated:  June 05, 2002

Status

  Not Vulnerable

Vendor Statement

F-Secure products are not vulnerable.

We do not have a product implemented as HTTP proxy. FSAV for Firewalls is designed to scan HTTP traffic, and works in conjunction with a CVP-compliant firewall such as Check Point FireWall-1, Cyberguard, etc.

Customers using FSAV for Firewalls should check if their firewall software is affected and contact the firewall vendor to get a patch/workaround.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

F5 Networks

Notified:  April 19, 2002 Updated:  May 28, 2002

Status

  Not Vulnerable

Vendor Statement

F5 Networks' EDGE-FX Cache product does not currently perform HTTP content/virus scanning.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Hewlett-Packard Company

Notified:  April 19, 2002 Updated:  May 29, 2002

Status

  Not Vulnerable

Vendor Statement

[HP does not] have any products that make use of HTTP CONNECT method tunnels.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sophos

Notified:  April 19, 2002 Updated:  May 30, 2002

Status

  Not Vulnerable

Vendor Statement

Sophos does not provide HTTP virus scanning at this time.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

The CERT/CC thanks Peter Bieringer and AERAsec Network Services and Security GmbH for information used in this document.

This document was written by Art Manion.

Other Information

CVE IDs: None
Severity Metric: 8.69
Date Public: 2002-02-22
Date First Published: 2002-10-15
Date Last Updated: 2002-10-16 01:45 UTC
Document Revision: 18

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.