CVE-2001-0669

Severity

75%

Complexity

99%

Confidentiality

106%

Various Intrusion Detection Systems (IDS) including (1) Cisco Secure Intrusion Detection System, (2) Cisco Catalyst 6000 Intrusion Detection System Module, (3) Dragon Sensor 4.x, (4) Snort before 1.8.1, (5) ISS RealSecure Network Sensor 5.x and 6.x before XPU 3.2, and (6) ISS RealSecure Server Sensor 5.5 and 6.0 for Windows, allow remote attackers to evade detection of HTTP attacks via non-standard "%u" Unicode encoding of ASCII characters in the requested URL.

CVSS 2.0 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P).

Overview

First reported 23 years ago

2001-10-30 05:00:00

Last updated 8 years ago

2016-10-18 02:11:00

Affected Software

Cisco Catalyst 6000 Intrusion Detection System Module

Cisco Secure Intrusion Detection System

Internet Security Systems RealSecure Server Sensor 5.5

5.5

Internet Security Systems RealSecure Server Sensor 6.0

6.0

Snort Snort 1.8.1

1.8.1

References

20010905 %u encoding IDS bypass vulnerability

20010905 Cisco Secure Intrusion Detection System Signature Obfuscation Vulnerability

Patch, Vendor Advisory

VU#548515

US Government Resource

3292

20010905 Multiple Vendor IDS Unicode Bypass Vulnerability