Description
JDKChat is prone to a remote integer-overflow vulnerability. A remote attacker may exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely crash the application, denying service to legitimate users.
aleks@tux ~ $ telnet 192.168.0.1 7777
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character is '^]'.
Welcome To jdkchat v1.5 by J.D. Koftinoff Software, Ltd.
http://www.jdkoftinoff.com/
and modified by Aditya Godbole (
[email protected])
Commands available:
/who -- (list all users along with their connection numbers)
/exit -- (exit chat room)
/local -- (toggle local mode for your telnet session)
/[connection number] message -- (send private message to user at specified connection number)
JDKCHAT: Aleks just entered the room.
JDKCHAT: Users = Aleks:0
Aleks >
// And after we run the PoC :
JDKCHAT: PwNzOr just entered the room.
Aleks >Connection closed by foreign host.
aleks@tux ~ $