----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

Join the FREE BETA test of the Network Software Inspector (NSI)!
http://secunia.com/network_software_inspector/

The NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
Progress Information Disclosure and Data Manipulation

SECUNIA ADVISORY ID:
SA24988

VERIFY ADVISORY:
http://secunia.com/advisories/24988/

CRITICAL:
Highly critical

IMPACT:
Manipulation of data, Exposure of system information, Exposure of
sensitive information, System access

WHERE:
>From remote

SOFTWARE:
Progress 7.x
http://secunia.com/product/683/
Progress 8.x
http://secunia.com/product/681/
Progress 9.x
http://secunia.com/product/682/

DESCRIPTION:
suresync has reported a vulnerability and a security issue in
Progress, which can be exploited by malicious people to disclose
potentially sensitive information and to manipulate data.

Input passed to the "WService" parameter in scripts/cgiip.exe in
Progress Webspeed Messenger is not properly verified before being
used. This can be exploited to read and modify arbitrary files by
invoking /webutil/_cpyfile.p via the said parameter.

Successful exploitation allows execution of arbitrary Webspeed code.

This vulnerability is reported in Progress releases prior to version
10.

It is also possible to disclose the operating system and the Progress
version of a Webspeed server by invoking /webutil/about.r via the said
parameter.

This security issue reportedly affects all Progress releases.

SOLUTION:
Upgrade to version 10.

Restrict access to the service.

PROVIDED AND/OR DISCOVERED BY:
suresync

ORIGINAL ADVISORY:
http://www.ishare.nl/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------