iParty.daemon.DoS.txt

`Date: Sat, 08 May 1999 13:11:34 EDT  
From: wh00t X <[email protected]>  
To: [email protected]  
Cc: [email protected], [email protected]  
Subject: iParty Daemon Vulnerability w/ Exploit Code (worse than thought?)  
  
Hi,  
  
iParty, by Intel Experimental Technologies Department, (unofficial   
information source at http://www.bumpkinland.com/iparty/), is a small voice   
conferencing program, which includes a server daemon in the download. It is   
handy for quick internet voice chat, but the server can be killed by sending   
a large amount of extended characters to the server port, which is 6004 by   
default, without being logged. The daemon either crashes quietly or GPF   
(varies from box to box).  
I've been told an advisory of some sort has already been released for   
this particular vulnerability but I believe the matter needs further   
attention because:  
  
1. While there are other newer and better voice conferencing programs out,   
iParty continues to be widely used.  
2. This vulnerability may be worse than thought: I tested my program   
(attached to message) against 4 random Windows 95/98 boxes with the daemon   
running, and after 2 or 3 crashes in a row, on top of crashing the iParty   
daemon, some experienced disconnection from the internet, ICQ and/or   
Rnaapp.exe, and one was even forced to reboot after the Rnaapp.exe crash.  
  
Thanks,  
Ka-wh00t  
  
`