Secunia

Nexus has discovered a security issue in Melange Chat Server, which potentially can be exploited by malicious people to disclose certain sensitive information.

The security issue is caused due to the chat server sending an error message to all connected users when it receives an unknown command. The message contains the data that was received. This can potentially be exploited to disclose the user's cookie by e.g. tricking the user to connect to the chat server using a browser.

Example:
http://[host]:6666

Successful exploitation requires that the chat server is hosted on the same domain as a web application that relies on cookie for session management.

The security issue has been confirmed in version 1.10. Other versions may also be affected.

Solution
Use another product.

Provided and/or discovered by
Nexus

Changelog
Further details available in Customer Area

Original Advisory
http://www.oh2600.com/forum/viewtopic.php?t=43

Deep Links
Links available in Customer Area