Macromedia Sitespring Database Engine Denial Of Service Vulnerability

Bugtraq ID:	5132
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-1026
Remote:	Yes
Local:	No
Published:	Jul 01 2002 12:00AM
Updated:	Jul 12 2009 05:56PM
Credit:	Discovery of this issue is credited to Peter Gründl <[email protected]>.
Vulnerable:	Macromedia Sitespring 1.2 .0
Not Vulnerable:

Macromedia Sitespring Database Engine Denial Of Service Vulnerability

A vulnerability has been reported in Macromedia Sitespring 1.2.0(277.1) using Sybase runtime engine v7.0.2.1480. It is possible to crash the Sybase runtime engine and Sitespring web services by sending a malformed request to the database engine.

Other versions may also be affected.

Macromedia Sitespring Database Engine Denial Of Service Vulnerability

The following example was submitted:

If the sybase database engine receives 1077 x chr(2) + \r\n\r\n it crashes. The web service will crash shortly after the database engine stops.

Macromedia Sitespring Database Engine Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Macromedia Sitespring Database Engine Denial Of Service Vulnerability

References:

• Macromedia Homepage (Macromedia)