Description
The Web Administrator service (STEMWADM.EXE) in Websense Personal Email Manager 7.1 before Hotfix 4 and Email Security 7.1 before Hotfix 4 allows remote attackers to cause a denial of service (crash) by sending a HTTP GET request to TCP port 8181 and closing the socket before the service can send a response.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Websense Email Security - Denial of Service EDB-9980 · dos · Oct 20, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://sotiriu.de/adv/NSOADV-2009-002.txt
- http://kb.websense.com/display/4/kb/article.aspx?aid=4786
- 36740 vdb-entry
- 20091020 NSOADV-2009-002: Websense Email Security Web Administrator DoS mailing-list
- http://kb.websense.com/article.aspx?article=4786&p=12
- ADV-2009-2987 vdb-entry
- 37091 third-party-advisory