Kbase P123826: WebSpeed agents stay busy when calling _admin.r with no parameter
| Autor |
Progress Software Corporation - Progress |
| Acesso |
Público |
| Publicação |
11/05/2007 |
|
Status: Unverified
FACT(s) (Environment):
Progress 9.x2
OpenEdge 10.x
WebSpeed 3.x
SYMPTOM(s):
WebSpeed agents stay busy when calling _admin.r with no parameter
Using messenger URL ending with _admin.r with no additional parameters in the query string
Sample URL
http://host/scripts/cgiip.exe/WService=wsbroker1/_admin.r
Remote denial of service attack is possible against WebSpeed when such crafted URL is used
Issue occurs also when deploying in "Production" mode
CAUSE:
This is a known issue being investigated by development
FIX:
The recommended immediate workaround is to rename $DLC/src/_admin.p, $DLC/tty/_admin.r and $DLC/gui/_admin.r.
Network administrators should also set up the web server to log any attempts to access URLs ending with _admin.r / _admin.p.