usd-2018-0016 | Lexware Professional 2017/17.02

Advisory ID: usd-2018-0016
CVE Number: N/A
Affected Product: Lexware Professional 2017
Affected Version: 17.02
Vulnerability Type: Denial of Service
Security Risk: High
Vendor URL: https://shop.lexware.de/reisekosten-abrechnung
Vendor Status: Fixed

Description

The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

Sometimes the attacker can inject and execute arbitrary code while performing a DoS attack in order to access critical information or execute commands on the server.
Denial-of-service attacks significantly degrade the service quality experienced by legitimate users. These attacks introduce large response delays, excessive losses, and service interruptions, resulting in direct impact on availability.

As stressed in the advisories usd-2018-0013, usd-2018-0014 and usd-2018-0015 the lack of ability to change the default database connection credentials within the application client, indicates that any changes to the encrypted password effectively prevents clients from successfully connecting to the database and thus providing an efficient DoS.

Proof of Concept

A sample screenshot is provided to enhance the ease of understanding.