Secunia

mrhinkydink has reported a security issue in Websense, which can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to the Websense ISAPI Filter plug-in improperly filtering HTTP requests. This can be exploited to bypass URL filtering rules and access restricted websites without monitoring by including an HTTP "Via" header in outgoing HTTP requests.

The security issue is reported in version 6.3.0 with Hotfix 54 or later, configured with Microsoft ISA Server 2004 or 2006 or with Microsoft Forefront TMG 2010.

Solution
Disable the "IgnoreForwardedRequest" configuration option (please see the vendor's advisory for details). Apply Hotfix 17 for version 7.5.0.

Provided and/or discovered by
mrhinkydink

Changelog
Further details available in Customer Area

Original Advisory
Websense:
http://kb.websense.com/display/4n/kb/article.aspx?aid=5117
http://kb.websense.com/display/4n/kb/article.aspx?aid=5167

mrhinkydink:
http://mrhinkydink.blogspot.com/2010/05/websense-633-via-bypass.html
http://mrhinkydink.blogspot.com/2010/08/websenseisa-via-bypass-redux.html

Deep Links
Links available in Customer Area