Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Hubbard, Dan (dhubbardwebsense.com)
Date: Thu Dec 13 2007 - 08:49:08 CST
An added note on this...
Customers do not need to download nor install any new patch for this
fix. It was automatically updated and installed with our nightly
protocol signature updates.
[mailto:full-disclosure-bounceslists.grok.org.uk] On Behalf Of The
Sent: Wednesday, December 12, 2007 3:32 PM
To: bugtraqsecurityfocus.com; Full-Disclosure
Subject: [Full-disclosure] Fwd: Websense 6.3.1 Filtering Bypass
Mr. HinkyDink would like to share the following with the Security
---------- Forwarded message ----------
Date: Dec 12, 2007 6:05 PM
Subject: Websense 6.3.1 Filtering Bypass
Please share this with your little friends...
Websense Policy Filtering Bypass
discovered by mrhinkydink
PRODUCT: Websense Enterprise 6.3.1
EXPOSURE: Web Filtering Bypass
By spoofing the User-Agent header it is possible to bypass filtering
to a lesser extent, monitoring in a Websense Enterprise 6.3.1
PROOF OF CONCEPT
The following was tested in an unpatched 6.3.1 system using the ISA
integration product. It is assumed it will work with other integration
products but this has not been tested. Other User Agents may also work.
I. Install FireFox 2.0.x
II. Obtain and install the User Agent Switcher browser plug-in by Chris
III. Add the following User Agents to the plug-in
User Agent : RealPlayer G2
Description: MSN Messenger
User Agent : MSMSGS
User Agent : StoneHttpAgent
IV. Change FireFox's User Agent to any one of the preceding values
V. Browse to a filtered Web site
VI. Content is allowed
Content browsed via this method will be recorded in the Websense
as being in the "Non-HTTP" category.
Websense KnowledgeBase article #976
The vendor acknowledges this behavior in the aforementioned article.
Disable the protocols mentioned above.
Websense has repaired this issue in database #92938
mrhinkydink is not to be confused with the blogger by the same name
c. MMVII mrhinkydink
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
Protected by Websense Messaging Security ? www.websense.com