F-Secure Policy Manager FSMSH.DLL Remote Denial of Service Vulnerability
BID:24233
Info
F-Secure Policy Manager FSMSH.DLL Remote Denial of Service Vulnerability
| Bugtraq ID: | 24233 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2007-2964 |
| Remote: | Yes |
| Local: | No |
| Published: | May 30 2007 12:00AM |
| Updated: | May 07 2015 05:37PM |
| Credit: | David Maciejak reported this issue to the vendor. |
| Vulnerable: |
F-Secure Policy Manager 7.00 F-Secure Policy Manager 6.00 F-Secure Policy Manager 5.70 F-Secure Policy Manager 5.11 |
| Not Vulnerable: |
F-Secure Policy Manager 7.01 |
Discussion
F-Secure Policy Manager FSMSH.DLL Remote Denial of Service Vulnerability
F-Secure Policy Manager is prone to a remote denial-of-service vulnerability because the application fails to propelry handle unexpected conditions.
Exploiting this issue allows remote attackers to crash affected applications, denying further service to legitimate users. The vendor states that this application is typically available only to internal networks, making remote exploits over the Internet less likely.
Versions of F-Secure Policy Manager prior to 7.01 are vulnerable.
F-Secure Policy Manager is prone to a remote denial-of-service vulnerability because the application fails to propelry handle unexpected conditions.
Exploiting this issue allows remote attackers to crash affected applications, denying further service to legitimate users. The vendor states that this application is typically available only to internal networks, making remote exploits over the Internet less likely.
Versions of F-Secure Policy Manager prior to 7.01 are vulnerable.
Exploit / POC
F-Secure Policy Manager FSMSH.DLL Remote Denial of Service Vulnerability
Attackers may use a browser to exploit this issue.
The following proof-of-concept code is available:
Attackers may use a browser to exploit this issue.
The following proof-of-concept code is available:
Solution / Fix
F-Secure Policy Manager FSMSH.DLL Remote Denial of Service Vulnerability
Solution:
The vendor has released an advisory along with fixes to address this issue. Please see the references for more information.
F-Secure Policy Manager 5.70
F-Secure Policy Manager 7.00
F-Secure Policy Manager 6.00
Solution:
The vendor has released an advisory along with fixes to address this issue. Please see the references for more information.
F-Secure Policy Manager 5.70
-
F-Secure fspms-700-60x-570-hotfix2.zip
ftp://ftp.f-secure.com/support/hotfix/fspm/fspms-700-60x-570-hotfix2.z ip
F-Secure Policy Manager 7.00
-
F-Secure fspms-700-60x-570-hotfix2.zip
ftp://ftp.f-secure.com/support/hotfix/fspm/fspms-700-60x-570-hotfix2.z ip
F-Secure Policy Manager 6.00
-
F-Secure fspms-700-60x-570-hotfix2.zip
ftp://ftp.f-secure.com/support/hotfix/fspm/fspms-700-60x-570-hotfix2.z ip
References
F-Secure Policy Manager FSMSH.DLL Remote Denial of Service Vulnerability
References:
References:
- F-Secure Policy Manager Product Page (F-Secure)
- F-Secure Security Bulletin FSC-2007-4 (F-Secure)