James Bercegay has reported a vulnerability in Emulive Server4, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service).

1) A vulnerability caused due to an error in the handling of session IDs can be exploited to bypass the user authentication by supplying an empty session ID.

Successful exploitation grants access to the administrator section.

2) A problem in the handling of incoming traffic on port 66/tcp can be exploited by sending a sequence of eight or more carriage returns.

Successful exploitation causes a vulnerable service to become unresponsive.

The vulnerabilities have been reported in Commerce Edition Build 7560. Other versions may also be affected.

Solution
Restrict access to the web server and restrict traffic to port 66/tcp.

Provided and/or discovered by
James Bercegay, GulfTech Security Research Team.

Changelog
Further details available in Customer Area

Original Advisory
http://www.gulftech.org/?node=research&article_id=00051-09202004

Deep Links
Links available in Customer Area