CVE-2007-3615 Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) vi...
HighCVSS 7.8
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web cache.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap internet communication manager | All versions | No fix listed |
| sap web application server | = 6.10 | No fix listed |
| sap web application server | = 6.20 | No fix listed |
| sap web application server | = 6.40 | No fix listed |
| sap web application server | = 7.0 | No fix listed |
| sap web application server | = 7.0.10 | No fix listed |
References
- 20070705 Internet Communication Manager Denial Of Service Attack mailing-list
- 38095 vdb-entry
- 25964 patch third-party-advisory vendor-advisory
- 2875 third-party-advisory
- www.ngssoftware.com vendor-advisory
- 20070705 Internet Communication Manager Denial Of Service Attack mailing-list
- 24774 vdb-entry
- 1018336 vdb-entry
- ADV-2007-2450 vdb-entry
- sap-icman-dos(35278) vdb-entry