CVE-2002-0440

Description

Trend Micro InterScan VirusWall HTTP proxy 3.6 with the "Skip scanning if Content-length equals 0" option enabled allows malicious web servers to bypass content scanning via a Content-length header set to 0, which is often ignored by HTTP clients.

Affected products

• Trend Micro / interscan_viruswall3.6 – 3.6
• Trend Micro / interscan_viruswall3.51 – 3.51

Exploits & proofs of concept

• exploit-dbTrend Micro Interscan VirusWall 3.5/3.6 - Content-Length Scan Bypassby Jochen Thomas Bauer

References

• MISChttp://www.inside-security.de/vwall_cl0.html
• MAILING_LISThttp://seclists.org/lists/bugtraq/2002/Mar/0162.html
• MISChttp://www.iss.net/security_center/static/8425.php
• MISChttp://www.securityfocus.com/bid/4265