Razor-agents HTML messages denial of service
| razor-agents-html-messages-dos (21046) |  Medium Risk |
Description:
Razor-agents is vulnerable to a denial of service, caused by an error in the pre-processing of certain HTML messages. A remote attacker can send a specially-crafted HTML message, which can cause the application to crash.
Consequences:
Denial of Service
Remedy:
Upgrade to the latest version of Razor-agents (2.72 or later), available from the Razor-agents Download Web site. See References.
For Debian GNU/Linux 3.1 (Sarge):
Upgrade to the latest version of razor (2.670-1sarge2 or later), as listed in DSA-738-1. See Reference.
For SUSE Linux:
Upgrade to the latest Razor-Agents listed below. Refer to SUSE Security Announcement SUSE-SA:2005:035 for more information. See References.
x86 Platform:
SUSE Linux 8.2: 126-122 or later
x86 and x86-64 Platforms:
SUSE Linux 9.3: 67-3.2 or later
SUSE Linux 9.2: 61-3.2 or later
SUSE Linux 9.1: 36-59.4 or later
SUSE Linux 9.0: 34-54 or later
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2005-06-17 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- Razor-agents Download Web site: Select a mirror for file: razor/razor-agents 2.72.tar.gz.
- Razor-agents Web site: Vipul's Razor: home.
- BID-13984: Vipul Razor-agents Multiple Unspecified Denial Of Service Vulnerabilities
- CVE-2005-2024: Vipul Razor Agents (razor-agents) before 2.70 allows remote attackers to cause a denial of service via (1) certain unusual HTML messages or (2) certain malformed headers such as Content-Type.
- DSA-738: razor -- remote denial of service
- GLSA-200506-17: SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability
- SUSE-SA:2005:035: razor-agents: denial of service attack
Platforms Affected:
- Debian Debian Linux 3.1
- Gentoo Linux
- Razor-agents Razor-agents prior to 2.72
- SUSE SuSE Linux 8.2
- SUSE SuSE Linux 9.0
- SUSE SuSE Linux 9.1
- SUSE SuSE Linux 9.2
- SUSE SuSE Linux 9.3
Reported:
Jun 17, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net