Webwasher Denial Of Service Vulnerability

April 3rd, 2008

Webwasher Denial Of Service Vulnerability

Webwasher denial of service vulnerability has been reported by National Australia Bank Security. Secure Computing Webwasher 6.6.3 build 3102 and older versions running on CGLinux 4/5, RHEL 4, Debian 4, SLES10 are vulnerable. A special handcrafted URL has to be sent to Webwasher on the affected Linux systems which will then freeze the application. National Australia Bank Security Assurance has provided an undisclosed proof of concept.

Due to a change in the behavior of newer Linux systems a Denial of Service attack can be launched against Webwasher running on Linux based operating systems which will freeze the Webwasher service. If this happens, Webwasher becomes unable to handle any request until the Webwasher service is restarted.

The attack can be initiated by an internal user sending a specially crafted URL to Webwasher. It could also be exploited by an external attacker by redirecting proxy users to the exploit URL.

Users of all Webwasher appliances version 6.x (CGLinux 4 or 5) are affected. All Webwasher installations on current versions build numbers 3150 or newer are not affected. Webwasher Software customers on Windows, Solaris, Linux RedHat Enterprise 3, Linux Suse 8 and 9, Debian 3.1 and Webwasher appliances running with CGLinux 3.x are not affected.

Not vulnerable:

Secure Computing Webwasher Builds 3150 and newer (all platforms)
Webwasher (all versions) for Windows
Webwasher (all versions) for Solaris
Webwasher (all versions) for some Linux (RHEL 3, SLES8, SLES9, Debian 3)
Webwasher 5.3 appliances (running CGLinux 3.x)

Solution:

The vendor has released Webwasher versions to address Webwasher 6.6.3 build 3150 and Webwasher 5.3.0 build 3159. Both are available at: https://extranet.webwasher.com/download/csm/index.html. Webwasher appliances can be upgraded automatically via the GUI.

Share this item with others:

More on CyberInsecure:

GoDaddy.com Hosting Hit By A Major Denial-of-Service Attack

Zero-day Microsoft Windows NSlookup.exe Vulnerability Exploited In The Wild

Australian Atheist Websites Taken Offline By Distributed Denial Of Service Attacks

Denial-of-service Attack Hits Wikileaks During US Diplomatic Cables Leak Release

avast! Home And Professional aavmker4.sys Privilege Escalation

Posted in Vulnerabilities |

Print This Post

This entry was posted on Thursday, April 3rd, 2008 at 8:38 am and is filed under Vulnerabilities. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

If you found this information useful, consider linking to it from your own website.
Just copy and paste the code below into your website (Ctrl+C to copy)
It will look like this: Webwasher Denial Of Service Vulnerability

Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.