PT-2007-3830 · Progress · Progress+1

Published 2007-05-04 · Updated 2018-10-16 · CVE-2007-2506

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Progress OpenEdge versions 10.x Progress Software Progress versions 9.1e and certain other 9.x versions

Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and daemon hang. This can be achieved by invoking edit.r with no additional parameters via a messenger URL. For example, requests for cgiip.exe or wsisa.dll with WService=wsbroker1/ edit.r in the PATH INFO can demonstrate this.

Recommendations For Progress OpenEdge versions 10.x, update to a version that includes a fix for this issue. For Progress Software Progress versions 9.1e and certain other 9.x versions, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the edit.r URL to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2007-2506

Affected Products

Progress

Progress Openedge

References · 9

• 🔥 https://exploit-db.com/exploits/29943 · Exploit
• 🔥 http://securityfocus.com/bid/23778 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2506 · Security Note
• http://secunia.com/advisories/25129 · Vendor Advisory
• http://securityfocus.com/archive/1/467375/100/0/threaded · Note
• http://osvdb.org/35541 · Note
• http://progress.atgnow.com/esprogress/resultDisplay.do?gotoLink=115&docType=1006&clusterName=CombinedCluster&contentId=12&groupId=3&answerGroup=1&score=1932&page=http%3A%2F%2Fprogress.atgnow.com%2Fesprogress%2Fdocs%2FSolutions%2FProgress%2FESERVER_P123694.xhtml&result=0&excerpt=P123694 · Note
• http://ishare.nl · Note
• http://securityfocus.com/archive/1/467376/100/0/threaded · Note