PT-2006-1954 · Ipswitch · Ipswitch Whatsup Professional 2006

Josh Zlatin-Amishav · Publicado 2006-02-28 · Atualizado 2018-10-18 · CVE-2006-0911

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Ipswitch WhatsUp Professional 2006

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, via crafted requests to "Login.asp". This may involve the In and btnLogIn parameters, or malformed btnLogIn parameters, possibly due to missing or incorrect bracket characters. Examples of such crafted requests include "&btnLogIn=[Log&In]=&" or "&b;tnLogIn=[Log&In]=&" in the URL.

Recommendations For Ipswitch WhatsUp Professional 2006, consider restricting access to the "Login.asp" endpoint until a fix is available. As a temporary workaround, avoid using the btnLogIn parameter in the affected API endpoint.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2006-0911

Produtos afetados

Ipswitch Whatsup Professional 2006

Referências · 10

• 🔥 https://exploit-db.com/exploits/27258 · Exploit
• 🔥 http://zur.homelinux.com/Advisories/ipswitch_dos.txt · Exploit
• 🔥 http://osvdb.org/23494 · Exploit
• 🔥 http://securityfocus.com/bid/16771 · Exploit
• http://securityfocus.com/archive/1/425780/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0911 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24864 · Nota
• http://securityreason.com/securityalert/472 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0911 · Nota
• http://vupen.com/english/advisories/2006/0704 · Aviso do Fabricante