Razor-agents infinite loop denial of service
| razor-agents-infinite-loop-dos (21047) |  Low Risk |
Description:
Razor-agents is vulnerable to a denial of service attack, caused by a vulnerability in the discovery logic. A remote attacker can send a specially-crafted HTML message, causing discovery logic to fail and enter into an infinite loop, resulting in a denial of service.
Platforms Affected:
- Debian, Debian Linux 3.1
- Gentoo, Linux
- SourceForge, Razor-agents prior to 2.72
Remedy:
Upgrade to the latest version of Razor-agents (2.72 or later), available from the Razor-agents Download Web site. See References.
For SUSE Linux:
Upgrade to the latest Razor-Agents listed below. Refer to SUSE Security Announcement SUSE-SA:2005:035 for more information. See References.
x86 Platform:
SUSE Linux 8.2: 126-122 or later
x86 and x86-64 Platforms:
SUSE Linux 9.3: 67-3.2 or later
SUSE Linux 9.2: 61-3.2 or later
SUSE Linux 9.1: 36-59.4 or later
SUSE Linux 9.0: 34-54 or later
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2005-06-17 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Denial of Service
References:
- Razor-agents Download Web site, Select a mirror for file: razor/razor-agents 2.72.tar.gz at http://prdownloads.sourceforge.net/razor/razor-agents-2.72.tar.gz?download.
- Razor-agents Web site, Vipul's Razor: home at http://razor.sourceforge.net/.
- BID-13984: Vipul Razor-agents Multiple Unspecified Denial Of Service Vulnerabilities
- CVE-2005-2024: Vipul Razor Agents (razor-agents) before 2.70 allows remote attackers to cause a denial of service via (1) certain unusual HTML messages or (2) certain malformed headers such as Content-Type.
- DSA-738: razor -- remote denial of service
- GLSA-200506-17: SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability
Reported:
Jun 17, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net