bugtraq - Multiple Vulnerabilities in Easy Chat Server 1.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040702084349.5F48B23F91@chernobyl.investici.org>
Date: Fri, 2 Jul 2004 08:43:49 -0000
From: "Donato Ferrante" <fdonato@...istici.org>
To: <bugtraq@...urityfocus.com>
Subject: Multiple Vulnerabilities in Easy Chat Server 1.2



                           Donato Ferrante


Application:  Easy Chat Server
              http://www.echatserver.com/

Version:      1.2

Bugs:         Multiple Vulnerabilities

Date:         02-Jul-2004

Author:       Donato Ferrante
              e-mail: fdonato@...istici.org
              web:    www.autistici.org/fdonato



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1. Description
2. The bugs
3. The code
4. The fix



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

----------------
1. Description:
----------------

Vendor's Description:

"Easy Chat Server is a easy, fast and affordable way to host and manage
your own real-time communication software, it allows friends/colleagues
to chat with you through a Web Browser (IE, Netscape, Mozilla, Opera
etc.) on any computer (Windows, Linux, Solaris...) without any special
plug-ins or software. It can help you setup your community chat rooms,
collaborative work sessions or online meetings."



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

-------------
2. The bugs:
-------------

The program has two DoS vulnerabilties, due to:

- long username
- fake users


[1] The program doesn't correctly manage the username, in fact if you
    try to send a big username string to the server it will crash.


[2] The program has no strong checks on the users who join into free
    rooms. In fact it's possible to add a large number of fake users
    and the chat server will go down.



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

-------------
3. The code:
-------------

To test the vulnerabilities:

[1] 
    GET /chat.ghp?username=aaaa[ 295 of a ]aaaa&password=&room=1&sex=0
    Host: http://[host]

[2] 
    GET /chat.ghp?username=FakeUser&password=&room=1&sex=0
    Host: http://[host]
    ( this will add a fake user with name: FakeUser )



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

------------
4. The fix:
------------

Vendor was contacted.
Bugs will be fixed in the next version.



xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx