[NT] Chat Anywhere DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 09/02/04

  • Next message: SecuriTeam: "[NEWS] Multiple Vulnerabilities in Oracle Database Server (40 Issues)" 
    To: list@securiteam.com
Date: 2 Sep 2004 12:51:18 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Chat Anywhere DoS
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.lionmax.com/chatanywhere.htm> Chat Anywhere is a "powerful
    chat server software for real-time chatting. With Chat Anywhere, you can
    easily design professional web-based chat rooms. You don't have to know
    any computer program language to use this software."

    The chat server can be caused to crash by connecting fake users to it.

    DETAILS

    Vulnerable Systems:
     * Chat Anywhere version 2.72a

    The chat server is unable to manage fake users. An attacker can crash the
    chat server and cause it to consume a lot of CPU resources. The CPU
    hogging effect is not limited to the server itself but propagates to all
    the real clients connected.

    Exploit:
    The following proof of concept is available from
    <http://www.autistici.org/fdonato/poc/ChatAnywhere[272a]DoS-poc.zip>
    http://www.autistici.org/fdonato/poc/ChatAnywhere[272a]DoS-poc.zip.

    And from <http://aluigi.altervista.org/poc/chatanydos.zip>
    http://aluigi.altervista.org/poc/chatanydos.zip.

    Vendor Status:
    The bug was initially found on 4 Dec 2003 in the version 2.72, and
    reported to the vendor by Luigi Auriemma, but the vendor probably forgot
    to fix it. So the vendor was contacted for the same bug in the next
    version 2.72a. Now the vendor is planning to fix the bug in the next
    release. In the meantime it is recommended to add password protection to
    protect the chat room.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:fdonato@autistici.org>
    Donato Ferrante.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Multiple Vulnerabilities in Oracle Database Server (40 Issues)"

    Relevant Pages

    • [NT] w3wp DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... 1/12/2006 - Vendor requested for additional info ... recv(conn_socket, szBuffer, 256, 0); ...
      (Securiteam)
    • [NT] Trend Micro HouseCall ActiveX Control Arbitrary Code Execution
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Trend Micro HouseCall ActiveX Control Arbitrary Code Execution ... The vulnerability is caused due to an implementation error within the ... 18/08/2008 - Vendor notified. ...
      (Securiteam)
    • [NT] Microsoft Hierarchical FlexGrid Control Integer Overflows (MS08-070)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Hierarchical FlexGrid Control Integer Overflows ... 28/08/2007 - Vendor notified. ...
      (Securiteam)
    • [NT] CA ARCserve Backup RPC "handle_t" Argument Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCserve Backup RPC "handle_t" Argument Vulnerability ... 24/10/2007 - Vendor notified. ... 21/05/2008 - Vendor notifies expected release in October 2008. ...
      (Securiteam)
    • [NT] Adobe PageMaker PMD File Processing Buffer Overflows
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The vulnerabilities are caused due to boundary errors when processing ... The vendor will be releasing a fix for the stack-based buffer overflow ... 02/06/2008 - Vendor asks for CVE identifier. ...
      (Securiteam)
    • Quantcast