Virtual Programming VP-ASP Denial Of Service Vulnerability

Bugtraq ID:	11228
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Sep 21 2004 12:00AM
Updated:	Sep 21 2004 12:00AM
Credit:	This vulnerability was reported by the vendor.
Vulnerable:	Virtual Programming VP-ASP 5.00
Not Vulnerable:

Virtual Programming VP-ASP Denial Of Service Vulnerability

It is reported that Virtual Programming VP-ASP is susceptible to a denial of service vulnerability.

This vulnerability allows an attacker to maintain connections to the database. It is conjectured that by exploiting this vulnerability multiple times, an attacker may be able to consume CPU resources, or possibly cause further database connections to fail. This will deny service to legitimate users.

This vulnerability is reported to affect version 5.0 of the package.

Virtual Programming VP-ASP Denial Of Service Vulnerability

An exploit is not required.

Virtual Programming VP-ASP Denial Of Service Vulnerability

Solution:
The vendor has provided the following patch to resolve this issue:

Locate the following code in the 'shoprestoreorder.asp' file:

If RestoreRedirecturl<>"" then
Responseredirect RestoreRedirectUrl
end if

Replace them with:

If RestoreRedirecturl<>"" then
Shopclosedatabase dbc
Responseredirect RestoreRedirectUrl
end if

Virtual Programming VP-ASP Denial Of Service Vulnerability

References:

• Fix Summary (Virtual Programming)
  
• VP-ASP Homepage (Virtual Programming )
  
• VP-ASP Security FAQ (Virtual Programming)