{"vuid":"VU#868219","idnumber":"868219","name":"Multiple vendors' HTTP content/virus scanners do not check data tunneled via HTTP CONNECT method","keywords":["HTTP","virus scanner","data tunnel","HTTP CONNECT","bypass scanning"],"overview":"Multiple vendors' HTTP anti-virus and content filters do not inspect the contents of HTTP CONNECT method tunnels. As a result, viruses or other restricted HTTP content may not be blocked.","clean_desc":"Many anti-virus and content filter products that are designed to inspect HTTP application data rely on HTTP proxy functionality to examine the contents of HTTP connections. In turn, HTTP proxy services commonly support the HTTP CONNECT method, which is designed to create a TCP connection that bypasses the normal application layer functionality of the proxy. Typically, the HTTP CONNECT method is used to tunnel HTTPS connections through an HTTP proxy. The application layer data in an HTTP CONNECT method tunnel is opaque to the proxy service. The default configurations of many HTTP proxy services allow arbitrary TCP connections to be made using the HTTP CONNECT method [VU#150227]. As most HTTP proxy services ignore the HTTP data contained within an HTTP CONNECT method tunnel, so do most HTTP anti-virus and content scanners. As a result, it may be possible to create an HTTP CONNECT method tunnel through a vulnerable HTTP anti-virus or content scanner and transfer viruses or other restricted HTTP content.","impact":"An attacker may be able to bypass HTTP anti-virus software and HTTP content restrictions by transferring data via an HTTP CONNECT method tunnel.","resolution":"Upgrade or Patch Upgrade or apply a patch as specified by your vendor.","workarounds":"Examine Tunneled Data If possible, configure your HTTP anti-virus/content filters to examine the application layer contents of HTTP CONNECT method tunnels. Use Desktop Anti-Virus Software Deploy and maintain updated anti-virus software on client systems.","sysaffected":"","thanks":"The CERT/CC thanks Peter Bieringer and \nAERAsec Network Services and Security GmbH\n for information used in this document.","author":"This document was written by Art Manion.","public":["http://www.aerasec.de/security/index.html?lang=en&id=ae-200202-051","http://www.ietf.org/rfc/rfc2817.txt","http://www.web-cache.com/Writings/Internet-Drafts/draft-luotonen-web-proxy-tunneling-01.txt"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2002-04-15T13:57:12Z","publicdate":"2002-02-22T00:00:00Z","datefirstpublished":"2002-10-15T20:06:01Z","dateupdated":"2002-10-16T01:45:14Z","revision":23,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"6","cam_internetinfrastructure":"2","cam_population":"8","cam_impact":"7","cam_easeofexploitation":"18","cam_attackeraccessrequired":"20","cam_scorecurrent":"8.694","cam_scorecurrentwidelyknown":"10.584","cam_scorecurrentwidelyknownexploited":"15.876","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":8.694,"vulnote":null}