ManageEngine OpManager MultipartRequestServlet fileName Denial of Service VulnerabilityZDI-15-164: April 29th, 2015
TippingPoint™ IPS Customer ProtectionTippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 16586. For further product information on the TippingPoint IPS:
This vulnerability allows remote attackers to create a denial of service condition on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the multipartRequest servlet. The issue lies in the failure to properly sanitize a filename. A remote attacker can exploit this vulnerability to delete files from the system.
Vendor ResponseManageEngine states:
Upgrade to Build 11500, or higher, to address this vulnerability.
2014-08-18 - Vulnerability reported to vendor
2015-04-29 - Coordinated public release of advisory
CreditThis vulnerability was discovered by:
Andrea Micalizzi (rgod)