SAP Web Application Server up to 6.39 enserver.exe denial of service

Summaryinfo

A vulnerability has been found in SAP Web Application Server up to 6.39 and classified as problematic. Affected is an unknown function of the file enserver.exe. Performing a manipulation results in denial of service. This vulnerability is identified as CVE-2006-6011. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in SAP Web Application Server up to 6.39 (Application Server Software). It has been classified as problematic. This affects an unknown part of the file enserver.exe. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. The summary by CVE is:

Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.exe crash) via a certain UDP packet to port 64999, aka "two bytes UDP crash," a different vulnerability than CVE-2006-5785.

The weakness was released 11/21/2006 as not defined posting (Bugtraq). It is possible to read the advisory at securityfocus.com. This vulnerability is uniquely identified as CVE-2006-6011 since 11/21/2006. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 6.40 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-21754, VDB-28119 and VDB-33350. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• SAP

Name

• Web Application Server

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16
• 6.17
• 6.18
• 6.19
• 6.20
• 6.21
• 6.22
• 6.23
• 6.24
• 6.25
• 6.26
• 6.27
• 6.28
• 6.29
• 6.30
• 6.31
• 6.32
• 6.33
• 6.34
• 6.35
• 6.36
• 6.37
• 6.38
• 6.39

License

• commercial

Website

• Vendor: https://www.sap.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion