phed.org

When performing a standard p/invoke method call in which a .NET string must be converted to an unmanaged LPSTR (char*), the .NET runtime performs a “bestfit” conversion.  This means some Unicode characters will be converted down to ASCII characters based on some mapping information.  This “bestfit” conversion can allow an attacker to bypass input validation filters.  For example, a filename might be checked to make sure it does not contain a backslash (“\”) character, or two periods (“..”).  By using Unicode characters an attacker could by pass those checks by providing a Unicode character that will be converted to the required ASCII character during the marshaling of the string.

Full article with character map.

~ by meddington on January 21, 2008.

Posted in Security