full-disclosure - Broadcast crash in Chatman 1.5.1 RC1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040927205835.237236fc.aluigi@autistici.org>
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Broadcast crash in Chatman 1.5.1 RC1

#######################################################################

                             Luigi Auriemma

Application:  Chatman
              http://www.vp-soft.com/software/chatman.php
Versions:     <= 1.5.1 RC1
Platforms:    Windows
Bug:          crash
Risk:         medium
Exploitation: remote, broadcast
Date:         27 September 2004
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Chatman is an intranet application combining chat (in IRC style), files
transfer and some games.

#######################################################################

======
2) Bug
======

Each data block exchanged by Chatman is constituited by a 32 bits
number used to identify the data size.

The amount of memory specified by this number is immediately allocated
but if it is too big (and so allocation fails) the program terminates
automatically.

Also if the program uses the TCP protocol is possible to crash any
Chatman host in the LAN simply sending a "new user" broadcast packet,
they will automatically connect to the attacker that can passively
exploit the bug as described previously.

#######################################################################

===========
3) The Code
===========

http://aluigi.altervista.org/poc/chatmanx.zip

#######################################################################

======
4) Fix
======

No fix.
Chatman is no longer supported.

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org