Zone Labs IMsecure Active Link Filter Bypass

[Kurczaba Associates advisories]

Zone Labs IMsecure Active Link Filter Bypass
http://www.kurczaba.com/html/security/0410141.htm
-------------------------------------------------

Overview:
A vulnerability has been discovered in the Zone Labs IMsecure Active Lin=
k Filter

Vendor:
Zone Labs (http://www.zonelabs.com)

Affected Systems/Configuration:
Versions of IMsecure and IMsecure Pro prior to 1.5

Vulnerability/Exploit:
The Active Link filter blocks potentially dangerous URLs in IM messages.
For example, IMsecure will remove URLs with extensions of .vbs, and .exe=
.. By using hex encoded characters in the file extension of the URL, it i=
s possible to bypass the Active Link filter.

Workaround:
Upgrade to version 1.5 or higher

Proof of Concept:
http://www.example.com/somefile.e%78e

In the example above, "78" is hex for "x".In plain English, the URL read=
s:

http://www.example.com/somefile.exe

Date Discovered:
April 1, 2004

Fix Available:
October 12, 2004

Severity:
Low

Credit:
Paul Kurczaba
Kurczaba Associates