Ipswitch Instant Messaging Remote Denial of Service Vulnerability

Bugtraq ID:	25031
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2007-3959
Remote:	Yes
Local:	No
Published:	Jul 23 2007 12:00AM
Updated:	May 07 2015 05:36PM
Credit:	The discoverer of this vulnerability wishes to remain anonymous.
Vulnerable:	Ipswitch Instant Messenger 2.0.5 .30
Not Vulnerable:	Ipswitch Instant Messenger 2.07

Ipswitch Instant Messaging Remote Denial of Service Vulnerability

Ipswitch Instant Messaging Server is prone to a remote denial-of-service vulnerability because the application fails to properly handle unexpected network data.

Successfully exploiting this issue allows remote attackers to crash the IM service, denying further instant messages for legitimate users.

Ipswitch IM Server 2.0.5.30 is vulnerable; other versions may also be affected.

Ipswitch Instant Messaging Remote Denial of Service Vulnerability

Attackers use readily available network utilities to exploit this issue.

Ipswitch Instant Messaging Remote Denial of Service Vulnerability

Solution:
The vendor has released Ipswitch Instant Messenger 2.07 to address this issue. Please see the references for more information.


Ipswitch Instant Messenger 2.0.5 .30

• Ipswitch Ipswitch IM Server 2.07
  http://ftp.ipswitch.com/ipswitch/product_downloads/iim.exe

Ipswitch Instant Messaging Remote Denial of Service Vulnerability

References:

• Ipswitch Instant Messaging Patches & Upgrades (Ipswitch)
  
• iDefense Security Advisory 07.23.07: Ipswitch Instant Messaging Server Denial of (iDefense Labs )
  
• Ipswitch Instant Messaging Server Denial of Service Vulnerability (iDefense)