[NT] Ipswitch Instant Messaging Server DoS Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Ipswitch Instant Messaging Server DoS Vulnerability
------------------------------------------------------------------------

SUMMARY

<http://www.ipswitch.com/products/instant_messaging/> Ipswitch Instant
Messaging is "the instant messaging software that is included with
Ipswitch Collaboration Suite (ICS). ICS is a collaboration software system
that includes email, shared folders, as well as instant messaging
capabilities". Remote exploitation of a Denial of Service vulnerability in
Ipswitch Inc.'s IM Server daemon allows unauthenticated attackers to crash
the service.

DETAILS

Vulnerable Systems:
* Ipswitch Inc's IM Server version 2.0.5.30

Immune Systems:
* Ipswitch Inc's IM Server version 2.0.7

Under default configuration, the IM Server service does not automatically
restart in the event of a failure.

The vulnerable section of code can be reached through any of the following
functions.
DoAttachVideoSender
DoAttachVideoReceiver
DoAttachAudioSender
DoAttachAudioReceiver

Analysis:
Exploitation allows unauthenticated remote attackers to crash the service.
The service does not auto-restart.

Successful exploitation would lead to a break in IM communications through
the server.

In order to exploit this vulnerability, the attacker must establish a TCP
session with the IM Server service on port 5179. No credentials are
required to reach the vulnerable code.

Workaround:
Employ firewalls, access control lists or other TCP/UDP restriction
mechanisms to limit access to systems and services.

Vendor response:
Ipswitch has addressed this vulnerability with the 2.07 release of their
IM Server. More information can be found at the following URL:
<http://www.ipswitch.com/support/instant_messaging/patch-upgrades.asp>

http://www.ipswitch.com/support/instant_messaging/patch-upgrades.asp

Disclosure timeline:
04/27/2007 - Initial vendor notification
07/17/2007 - Initial vendor response
07/23/2007 - Coordinated public disclosure

ADDITIONAL INFORMATION

The information has been provided by <mailto:labs-no-reply@idefense.com>
iDefense Labs.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=566>

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=566

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.