CVE-2007-2506: High severity Progress Progress vulnerability

Published May 4, 2007

Updated

WebSpeed 3.x in OpenEdge 10.x in Progress Software Progress 9.1e, and certain other 9.x versions, allows remote attackers to cause a denial of service (infinite loop and daemon hang) via a messenger URL that invokes edit.r with no additional parameters, as demonstrated by requests for cgiip.exe or wsisa.dll with WService=wsbroker1/edit.r in the PATHINFO.

Affected Software

5 affected components

Progress Progress=9.1e

Progress WebSpeed=3.0

Progress WebSpeed=3.1d

Progress WebSpeed=3.1a

Progress WebSpeed=3.1e

Remediation

Patch Available

http://www.securityfocus.com/bid/23778

Event History

May 4, 2007

CVE Published

01:19 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-2506?

CVE-2007-2506 is classified as a denial of service vulnerability that can lead to application instability.

How do I fix CVE-2007-2506?

To address CVE-2007-2506, it is recommended to update to a patched version of the affected software that mitigates this vulnerability.

Which software is affected by CVE-2007-2506?

CVE-2007-2506 affects Progress WebSpeed 3.x and Progress Software versions 9.1e and certain other 9.x versions.

What attack vector is used in CVE-2007-2506?

CVE-2007-2506 can be exploited via a specially crafted messenger URL that invokes _edit.r without parameters.

Can CVE-2007-2506 lead to data breaches?

CVE-2007-2506 primarily causes denial of service and does not directly lead to data breaches but can disrupt service availability.