BVRP SLWebmail GUI Applications Denial Of Service Vulnerability

Bugtraq ID:	7527
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 07 2003 12:00AM
Updated:	May 07 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to H D Moore <[email protected]>.
Vulnerable:	BVRP Software SLWebMail 3 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0
Not Vulnerable:

BVRP SLWebmail GUI Applications Denial Of Service Vulnerability

SLWebmail has been reported prone to a denial of service vulnerability.

It has been reported that an attacker may remotely access, request and execute several applications that are stored in a sub directory contained in the SLWebmail webroot.

The attacker may initiate recursive requests for these executables and consume server resources this will eventually lead to a denial of service condition.

BVRP SLWebmail GUI Applications Denial Of Service Vulnerability

Solution:
Although unconfirmed, this issue may be fixed in an updated version. Users are advised to contact the vendor for further information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

BVRP SLWebmail GUI Applications Denial Of Service Vulnerability

References:

• BVRP Software (BVRP Software)
  
• Re: Multiple Vulnerabilities in SLWebmail (H D Moore )