Easy Chat Server 1.x - Multiple Denial of Service Vulnerabilities

source: https://www.securityfocus.com/bid/10649/info

It is reported that Easy Chat Server is susceptible to multiple denial of service vulnerabilities.

The chat software is implemented as a web server serving a chat web application to clients. The software is reported to contain two denial of service vulnerabilities. The application improperly sanitizes user supplied URI data, and cannot handle large numbers of anonymous users created in chat rooms.

An attacker with remote access to an affected instance of this application could use these vulnerabilities to crash the service, denying service to legitimate users.

An example of a long username URI:
http://www.example.com/chat.ghp?username=aaaa[ 295 of a ]aaaa&password=&room=1&sex=0

An example of creating a fake user:
http://www.example.com/chat.ghp?username=FakeUser&password=&room=1&sex=0