PT-2006-1954 · Ipswitch · Ipswitch Whatsup Professional 2006

Josh Zlatin-Amishav · Published 2006-02-28 · Updated 2018-10-18 · CVE-2006-0911

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Ipswitch WhatsUp Professional 2006

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, via crafted requests to "Login.asp". This may involve the In and btnLogIn parameters, or malformed btnLogIn parameters, possibly due to missing or incorrect bracket characters. Examples of such crafted requests include "&btnLogIn=[Log&In]=&" or "&b;tnLogIn=[Log&In]=&" in the URL.

Recommendations For Ipswitch WhatsUp Professional 2006, consider restricting access to the "Login.asp" endpoint until a fix is available. As a temporary workaround, avoid using the btnLogIn parameter in the affected API endpoint.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2006-0911

Affected Products

Ipswitch Whatsup Professional 2006

References · 10

• 🔥 https://exploit-db.com/exploits/27258 · Exploit
• 🔥 http://zur.homelinux.com/Advisories/ipswitch_dos.txt · Exploit
• 🔥 http://osvdb.org/23494 · Exploit
• 🔥 http://securityfocus.com/bid/16771 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0911 · Security Note
• http://vupen.com/english/advisories/2006/0704 · Vendor Advisory
• http://securityfocus.com/archive/1/425780/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24864 · Note
• http://securityreason.com/securityalert/472 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0911 · Note