Enterasys Intrusion Prevention System Manual page 219

Table A-1 6.x to 7.0 Keyword Mapping (continued)
6.x Keyword
IIS_UNICODE_DECOD
E
IIS_UNICODE_DECOD
E_VERBOSE
7.0 XML Attribute
NSC/SC/C/HTTPAnalysis/iss-unicode
NSC/SC/C/HTTPAnalysis/verbose
Description
When enabled, Network Sensor interprets
Unicode representations the way that IIS does.
In brief, there are four things that IIS interprets
which are against Unicode and URI standards:
• The interpretation of unescaped Unicode bytes
The URI standard for HTTP states that any
character that cannot be expressed by use of ASCII
can be expressed through direct byte encoding.
This byte encoding must be escaped by a %. When
sending a web request with Unicode embedded, it
would look like, /scripts/..%c0%af../winnt/
system32/cmd.exe?/c+dir+c:\, where %c0%af is
the representation for /. However, IIS will accept the
byte \xc0\xaf directly if sent via a socket stream.
Network Sensor will decode any unescaped bytes
that are sent to a web server, when enabled.
• Allows additional Unicode representations that are
not legal Unicode representations for ASCII
characters.
IIS has all the legal representations for Unicode
characters plus several more that are illegal.
Network Sensor will decode all the representations
that IIS interprets and substitute the same ASCII
characters that IIS does.
• When certain codepages are installed, IIS will
accept Unicode representations that are base-32.
For example, with certain Asian codepages loaded,
IIS will accept the sequence %u0%o0%qf as a
Unicode representation for /. Network Sensor will
also detect these escaped byte sequences and
substitute the same representation that IIS does.
• Allows combination of unescaped and escaped
Unicode representations.
IIS will accept the Unicode representation %c0\xaf,
where %c0 are three bytes (the characters %, c,
and 0 each being a byte) and \xaf is the byte 0xAF.
Network Sensor will detect these hybrid Unicode
attacks as well, and substitute the same Unicode
representation that IIS would have done.
Technical Note
IIS_UNICODE_DECODE will try and convert all
escaped ASCII and unicode bytes. If a byte
sequence is invalid, the original sequence will be
left intact. For example, the escaped byte %$%
is invalid and would be left as it is.
The same as "NSC/SC/C/HTTPAnalysis/iss-
unicode" on page A-25, except that it logs events
when different decodes occur.
Technical Note
For details on how this evasion works, refer to
the "NSC/SC/C/HTTPAnalysis/iss-unicode" on
page A-25.
Creating Network Sensor Policies and Signatures A-25
6.x to 7.x Mappings