SOUND4 Impact/First/Pulse/Eco ICMP Flood Attack Vulnerability

A denial-of-service vulnerability has been identified in SOUND4 Impact, First, Pulse, and Eco versions 2.x. This vulnerability allows unauthenticated attackers to send ICMP signals to arbitrary hosts, potentially leading to network flooding attacks. The issue arises from the application's network command scripts, which can be exploited using the ping, traceroute, and DNS command functionalities. Affected products include SOUND4 Impact/Pulse/First (Version 2: 1.1/2.15), Impact/Pulse Eco 1.16, BigVoice4 1.2, BigVoice2 1.30, Stream 1.1/2.4.29, and WM2 (Kantar Media) 1.11.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition on the targeted external hosts by flooding them with ICMP traffic.

Reproduction

The vulnerability can be reproduced by sending POST requests to the vulnerable application's ping.php, traceroute.php, or dns.php scripts. These requests can include parameters that specify the target host for the ICMP flood attack.