George D. Gal has reported a vulnerability in Cisco PIX/ASA/FWSM, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error within the handling of fragmented HTTP requests. This can be exploited to bypass Websense URL filtering and gain access to restricted websites via HTTP GET requests that are fragmented into multiple packets.

Successful exploitation requires that PIX, ASA, or FWSM are configured to use Websense/N2H2 for content filtering.

The vulnerability has been reported in the following products:
* Cisco PIX software version 6.3.x and older.
* Cisco PIX/ASA software version 7.x.
* Cisco FWSM software version 2.3 and 3.1.

Solution
Update to the fixed versions.
Further details available in Customer Area

Provided and/or discovered by
George D. Gal

Original Advisory
Cisco:
http://www.cisco.com/warp/public/707/cisco-sr-20060508-pix.shtml

Virtual Security Research, LLC:
http://www.vsecurity.com/bulletins/advisories/2006/cisco-websense-bypass.txt

Deep Links
Links available in Customer Area