123 Flash Chat Server Arbitrary Remote File Creation Vulnerability

Bugtraq ID:	16235
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 13 2006 12:00AM
Updated:	Jan 13 2006 12:00AM
Credit:	Jesus Olmos Gonzalez discovered this issue.
Vulnerable:	TopLang Software 123 Flash Chat Server 5.0 TopCMM Computing 123 Flash Chat Server 5.1
Not Vulnerable:	TopCMM Computing 123 Flash Chat Server 5.1 _2

123 Flash Chat Server Arbitrary Remote File Creation Vulnerability

123 Flash Chat server is susceptible to an arbitrary remote file creation vulnerability. This issue is due to a lack of proper input sanitization of user-supplied data.

This issue allows remote attackers to create or overwrite arbitrary files on the server computer. This occurs with the privileges of the server process.

This issue affects versions 5.0, and 5.1 of 123 Flash Chat server; previous versions may also be affected.

123 Flash Chat Server Arbitrary Remote File Creation Vulnerability

An exploit is not required.

123 Flash Chat Server Arbitrary Remote File Creation Vulnerability

Solution:
The vendor has released version 5.1_2 of 123 Flash Chat server to address this issue.


TopLang Software 123 Flash Chat Server 5.0

• TopCMM Computing 123 Flash Chat Server Software Download
  http://www.123flashchat.com/download.html

TopCMM Computing 123 Flash Chat Server 5.1

• TopCMM Computing 123 Flash Chat Server Software Download
  http://www.123flashchat.com/download.html

123 Flash Chat Server Arbitrary Remote File Creation Vulnerability

References:

• 123 Flash Chat Homepage (TopCMM Software)
  
• 123 flash chat server software 5.1_2 released! (TopCMM Computing)
  
• [ISecAuditors Advisories] Arbitrary remote file creation in 123flashchat server (ISecAuditors Security Advisories )