CVE-2006-0911 - NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of ser

CVE-2006-0911

Summary

NmService.exe in Ipswitch WhatsUp Professional 2006 allows remote attackers to cause a denial of service (CPU consumption) via crafted requests to Login.asp, possibly involving the (1) "In]" and (2) "b;tnLogIn" parameters, or (3) malformed btnLogIn parameters, possibly involving missing "[" (open bracket) or "[" (closing bracket) characters, as demonstrated by "&btnLogIn=[Log&In]=&" or "&b;tnLogIn=[Log&In]=&" in the URL. NOTE: due to the lack of diagnosis by the original researcher, the precise nature of the vulnerability is unclear.

References

Vulnerable Configurations

cpe:2.3:a:ipswitch:whatsup:professional_2006:*:*:*:*:*:*:*
cpe:2.3:a:ipswitch:whatsup:professional_2006:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 18-10-2018 - 16:29)
Impact:
Exploitability:

CWE

CWE-399

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:P

refmap via4

bid	16771
bugtraq	20060222 IpSwitch WhatsUp Professional 2006 DoS
misc	http://zur.homelinux.com/Advisories/ipswitch_dos.txt
osvdb	23494
sreason	472
vupen	ADV-2006-0704
xf	whatsup-nmservice-dos(24864)

Last major update

18-10-2018 - 16:29

Published

28-02-2006 - 11:02

Last modified

18-10-2018 - 16:29