TOTVS ERP Microsiga Protheus Memory Corruption Denial Of Service Vulnerability

Bugtraq ID:	47342
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 13 2011 12:00AM
Updated:	Apr 13 2011 12:00AM
Credit:	Flavio do Carmo Junior aka waKKu from DcLabs Security Research Group
Vulnerable:	TOTVS ERP Microsiga Protheus 8 TOTVS ERP Microsiga Protheus 10
Not Vulnerable:

TOTVS ERP Microsiga Protheus Memory Corruption Denial Of Service Vulnerability

TOTVS ERP Microsiga Protheus is prone to a denial-of-service vulnerability due to a memory-corruption issue.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code execution may be possible; however, this has not been confirmed.

TOTVS ERP Microsiga Protheus Memory Corruption Denial Of Service Vulnerability

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/47342.py

TOTVS ERP Microsiga Protheus Memory Corruption Denial Of Service Vulnerability

Solution:
Reports indicate that updates are available; Symantec has not confirmed this. Please contact the vendor for more information.

TOTVS ERP Microsiga Protheus Memory Corruption Denial Of Service Vulnerability

References:

• Vendor Homepage (TOTVS)
  
• [DCA-2011-0010] TOTVS Microsiga Protheus ERP - Memory Corruption (Flavio do Carmo Junior aka waKKu )