Onderwerp: a litle bypass with IE

hello

im not a expert in this area, but i work in a intranet that haves the Squid/2.3.STABLE5 filtring all access's to the internet..

so i don't have access to the internet directaly, but i know that this proxy allow access to especific web sites.. so, in the past if i us this:

http://url@website_allowed.pt -> the vuln that is already discovered... i have access to the website that i want...

but in this days, this vuln is now fixed so...

in my test's i found this way to pass this proxy, using:

http://@@website_allowed.pt@my_url -> now i have access...

using @@url.pt@ i can bypass the proxy and access the internet, i don't know how faur, this could go!!

so i don't know if this is a bug from IE or just a simple bug from Squid.. ??? can anyone tell what we have in hands ?

PS: sorry my inglish



Nuno Costa
webcenter@sapo.pt
Portugal

This is a problem with Squid, as I was able to replicate the same bypassing
with Opera.

-----Original Message-----
From: Nuno Costa [mailto:webcenter@sapo.pt]
Sent: Monday, May 10, 2004 1:17 PM
To: bugtraq@securityfocus.com
Subject: a litle bypass with IE




hello im not a expert in this area, but i work in a intranet that haves
the Squid/2.3.STABLE5 filtring all access's to the internet.. so i don't
have access to the internet directaly, but i know that this proxy allow
access to especific web sites.. so, in the past if i us this:
http://url@website_allowed.pt -> the vuln that is already discovered... i
have access to the website that i want... but in this days, this vuln is
now fixed so... in my test's i found this way to pass this proxy, using:
http://@@website_allowed.pt@my_url -> now i have access... using @@url.pt@
i can bypass the proxy and access the internet, i don't know how faur, this
could go!! so i don't know if this is a bug from IE or just a simple bug
from Squid.. ??? can anyone tell what we have in hands ? PS: sorry my
inglish Nuno Costa webcenter@sapo.pt Portugal

Nuno Costa wrote :-

> hello
>
> im not a expert in this area, but i work in a intranet that haves the
> Squid/2.3.STABLE5 filtring all access's to the internet..
>
> so i don't have access to the internet directaly, but i know that this
> proxy allow access to especific web sites.. so, in the past if i us
> this:
>
> http://url@website_allowed.pt -> the vuln that is already discovered...
> > i have access to the website that i want...
>
> but in this days, this vuln is now fixed so...
>
> in my test's i found this way to pass this proxy, using:
>
> http://@@website_allowed.pt@my_url -> now i have access...
>
> using @@url.pt@ i can bypass the proxy and access the internet, i don't
> know how faur, this could go!!
>
> so i don't know if this is a bug from IE or just a simple bug from
> Squid.. ??? can anyone tell what we have in hands ?
>
> PS: sorry my inglish
>

Out of interest, do you happen to know if your proxy also uses Dansguardian? I ask because I work for the company behind CensorNet
(www.censornet.com) and we recently had to make a modification to the Dansguardian code in order that the school kids that form the vast
bulk of our user base couldn't get to prohibited sites by the slight of putting a trailing dot at the end of the url they wanted to visit.

We've fixed things such that invalid url's are no longer possible. I ask because, our Access Denied page also claims to be a service provided
by Squid/2.3 STABLE5. Yet the problem was with DG and not Squid.

Regards
Neil

(Company .sig below, although this is a personal email address)

--

Neil Briscoe
Adelix Ltd
e: neil.briscoe@adelix.com <mailto:neil.briscoe@adelix.com>
t: +44 (0) 1252 338751 / f: +44 (0) 1454 228820
s: PO BOX 2000, Yate, Bristol, BS37 1DS. http://www.adelix.com

Any views expressed in this email communication are those
of the individual sender, except where the sender specifically states
them to be the views of a member of Adelix Ltd. Adelix Ltd. does not
represent, warrant or guarantee that the integrity of this communication
has been maintained nor that the communication is free of errors or
interference.

Remove your proxy setttings from IE and try navigating to
http://@@website_allowed.pt@my_url - you will get an invalid syntax
error.




Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
24 Corporate Plaza #180
Newport Beach, CA 92660
http://www.pivx.com
thor@pivx.com
Stock symbol: PIVX
Phone: +1 (949) 231-8496
PGP: 0x5A276569
6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569

PivX defines a new genre in Desktop Security: Proactive Threat
Mitigation.=20
<http://www.pivx.com/qwikfix>


-----Original Message-----
From: Eric Norbut [mailto:eric@se-gi.com]=20
Sent: Monday, May 10, 2004 1:35 PM
To: 'Nuno Costa'; bugtraq@securityfocus.com
Subject: RE: a litle bypass with IE


This is a problem with Squid, as I was able to replicate the same
bypassing with Opera.

-----Original Message-----
From: Nuno Costa [mailto:webcenter@sapo.pt]
Sent: Monday, May 10, 2004 1:17 PM
To: bugtraq@securityfocus.com
Subject: a litle bypass with IE




hello im not a expert in this area, but i work in a intranet that
haves
the Squid/2.3.STABLE5 filtring all access's to the internet.. so i
don't
have access to the internet directaly, but i know that this proxy allow
access to especific web sites.. so, in the past if i us this:
http://url@website_allowed.pt -> the vuln that is already discovered...
i have access to the website that i want... but in this days, this vuln
is now fixed so... in my test's i found this way to pass this proxy,
using: http://@@website_allowed.pt@my_url -> now i have access... using
@@url.pt@ i can bypass the proxy and access the internet, i don't know
how faur, this could go!! so i don't know if this is a bug from IE or
just a simple bug from Squid.. ??? can anyone tell what we have in hands
? PS: sorry my
inglish Nuno Costa webcenter@sapo.pt Portugal