Progress WebSpeed Denial Of Service Vulnerability

Bugtraq ID:	23778
Class:	Input Validation Error
CVE:	CVE-2007-2506
Remote:	Yes
Local:	No
Published:	May 02 2007 12:00AM
Updated:	May 07 2015 05:39PM
Credit:	Eelko Neven is credited with the discovery of this vulnerability.
Vulnerable:	Progress WebSpeed 3.0 Progress WebSpeed 3.1 e Progress WebSpeed 3.1 d Progress WebSpeed 3.1 a
Not Vulnerable:

Progress WebSpeed Denial Of Service Vulnerability

WebSpeed is prone to a denial-of-service vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits can allow attackers to cause the application to become unresponsive, denying service to legitimate users.

Progress WebSpeed Denial Of Service Vulnerability

Attackers can use a browser to exploit this issue.

Example URIs have been provided:

http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/_edit.r
http://www.example.com/scripts/wsisa.dll/WService=wsbroker1/_edit.r

Example exploit code has also been provided:

• /data/vulnerabilities/exploits/23778.c

Progress WebSpeed Denial Of Service Vulnerability

Solution:
The vendor has released updates to address this issue; please see the references for details.

Progress WebSpeed Denial Of Service Vulnerability

References:

• Disable website access for sites running Webspeed ([email protected])
  
• Progress WebSpeed Product Webpage (Progress)
  
• response Progress: Denial of Service attack against WebSpeed possible ([email protected])
  
• Webspeed OpenEdge Dos exploit ([email protected])