Digi-Net Technologies DigiChat User IP Information Disclosure Vulnerability

Bugtraq ID:	5019
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 14 2002 12:00AM
Updated:	Jun 14 2002 12:00AM
Credit:	Credited to Alexander Mark <[email protected]>.
Vulnerable:	Digi-Net Technologies DigiChat 3.5
Not Vulnerable:

Digi-Net Technologies DigiChat User IP Information Disclosure Vulnerability

DigiChat is a web based chat application maintained by Digi-Net. DigiChat runs on most Microsoft Windows and UNIX platforms.

It is possible for chat users to obtain sensitive information about other chat visitors.

Reportedly, including '<Param Name="Showip"Value="True">' in the chat applet will reveal user IP addresses in the chat visitor's information details.

This issue has been reported in DigiChat 3.5, however other versions may also be affected by this.

Digi-Net Technologies DigiChat User IP Information Disclosure Vulnerability

No exploit code is required.

Digi-Net Technologies DigiChat User IP Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Digi-Net Technologies DigiChat User IP Information Disclosure Vulnerability

References:

• DigiChat Homepage (Digi-Net)