SAP Web Application Server Remote Denial of Service Vulnerability

Bugtraq ID:	20873
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 02 2006 12:00AM
Updated:	Nov 13 2006 09:57PM
Credit:	Nicob is credited with the discovery of this vulnerability.
Vulnerable:	SAP Web Application Server 7.0 SAP Web Application Server 6.40
Not Vulnerable:

SAP Web Application Server Remote Denial of Service Vulnerability

SAP Web Application Server is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to consume excessive system resources until the software becomes unresponsive to further calls, effectively denying service to legitimate users.

These versions are affected:

- 6.40 patch 135 and prior
- 7.00 patch 55 and prior.

SAP Web Application Server Remote Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

SAP Web Application Server Remote Denial of Service Vulnerability

Solution:
The vendor has released fixes to address this issue. Please see the references for more information.

SAP Web Application Server Remote Denial of Service Vulnerability

References:

• SAP Homepage (SAP)
  
• Multiple vulnerabilities in SAP Web Application Server (Nicob)
  
• Re: Multiple vulnerabilities in SAP Web Application Server 6.40 and7.00 (Nicob )
  
• Re: Multiple vulnerabilities in SAP Web Application Server 6.40 and7.00 (Nicob )