Razor-agents HTML messages denial of service
| razor-agents-html-messages-dos (21046) |  Low Risk |
Description:
Razor-agents is vulnerable to a denial of service, caused by an error in the pre-processing of certain HTML messages. A remote attacker can send a specially-crafted HTML message, which can cause the application to crash.
Platforms Affected:
- Debian, Debian Linux 3.1
- Gentoo, Linux
- SourceForge, Razor-agents prior to 2.72
- SuSE, SuSE Linux 8.2
- SuSE, SuSE Linux 9.0
- SuSE, SuSE Linux 9.1
- SuSE, SuSE Linux 9.2
- SuSE, SuSE Linux 9.3
Remedy:
Upgrade to the latest version of Razor-agents (2.72 or later), available from the Razor-agents Download Web site. See References.
For Debian GNU/Linux 3.1 (Sarge):
Upgrade to the latest version of razor (2.670-1sarge2 or later), as listed in DSA-738-1. See Reference.
For SUSE Linux:
Upgrade to the latest Razor-Agents listed below. Refer to SUSE Security Announcement SUSE-SA:2005:035 for more information. See References.
x86 Platform:
SUSE Linux 8.2: 126-122 or later
x86 and x86-64 Platforms:
SUSE Linux 9.3: 67-3.2 or later
SUSE Linux 9.2: 61-3.2 or later
SUSE Linux 9.1: 36-59.4 or later
SUSE Linux 9.0: 34-54 or later
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2005-06-17 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Denial of Service
References:
- Razor-agents Download Web site, Select a mirror for file: razor/razor-agents 2.72.tar.gz at http://prdownloads.sourceforge.net/razor/razor-agents-2.72.tar.gz?download.
- Razor-agents Web site, Vipul's Razor: home at http://razor.sourceforge.net/.
- BID-13984: Vipul Razor-agents Multiple Unspecified Denial Of Service Vulnerabilities
- CVE-2005-2024: Vipul Razor Agents (razor-agents) before 2.70 allows remote attackers to cause a denial of service via (1) certain unusual HTML messages or (2) certain malformed headers such as Content-Type.
- DSA-738: razor -- remote denial of service
- GLSA-200506-17: SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability
- SUSE-SA:2005:035: razor-agents: denial of service attack
Reported:
Jun 17, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net