SAP Internet Communication Manager Long URI Handling Denial of Service Vulnerability

Bugtraq ID:	24774
Class:	Design Error
CVE:	CVE-2007-3615
Remote:	Yes
Local:	No
Published:	Jul 05 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Mark Litchfield is credited with discovering this vulnerability.
Vulnerable:	SAP Web Application Server 7.0.10 SAP Web Application Server 7.0 SAP Web Application Server 6.40 SAP Web Application Server 6.20 SAP Web Application Server 6.10 SAP Internet Communication Manager (ICM) 0
Not Vulnerable:

SAP Internet Communication Manager Long URI Handling Denial of Service Vulnerability

Internet Communication Manager is prone to a remote denial-of-service vulnerability.

A remote attacker can exploit this issue to cause the affected service to crash, effectively denying service to legitimate users.

SAP Internet Communication Manager Long URI Handling Denial of Service Vulnerability

Attackers may exploit this issue through a browser.

SAP Internet Communication Manager Long URI Handling Denial of Service Vulnerability

Solution:
The vendor has released an update to address this issue. Contact the vendor for details on obtaining and applying the appropriate update.

SAP Internet Communication Manager Long URI Handling Denial of Service Vulnerability

References:

• Internet Communication Manager (ICM) (SAP)
  
• SAP Web Dispatcher as a Web Cache (SAP)
  
• Vendor Homepage (SAP)
  
• Internet Communication Manager Denial Of Service Attack (NGSSoftware)