Bybass HTTP ( extension files ) in ISA 2004

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Bybass HTTP ( extension files ) in ISA 2004
From: medozero@xxxxxxxxx
Date: 15 Jul 2006 14:47:18 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

hi ppl i just discover a bug in Microsoft Internet Security and Acceleration 
(ISA) Server which make you able to Bybass HTTP ( extension files ) just add # 
to the end of the file extension
ex: www.site.com/file.zip#
that will make you bybass the filter rule if the admin prevent you from 
downlaoding the extension zip
Copyright MedoZero 2006

Follow-Ups:
- Re: Bybass HTTP ( extension files ) in ISA 2004
  - From: Thor (Hammer of God)

Prev by Date: Re: Linux Kernel 2.6.x PRCTL Core Dump Handling -- Simple workaround
Next by Date: MS Power Point Multiple Vulnerabilities (powerpnt.exe)- POC
Previous by thread: EEYE: McAfee ePolicy Orchestrator Remote Compromise
Next by thread: Re: Bybass HTTP ( extension files ) in ISA 2004
Index(es):
- Date
- Thread