CVE-2010-0217 - Zeacom Chat Server JSESSIONID weak SessionID Vulnerability

2011-05-2100:00:00

vulners.com

JSON

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                    Packetninjas L.L.C
                   www.packetninjas.net

                -= Security  Advisory =-

Advisory:  Zeacom Chat Server JSESSIONID weak SessionID Vulnerability

Release Date: unknown
Last Modified: 09/27/2010
Author: Daniel Clemens [daniel.clemens[at]packetninjas.net]

Application: Zeacom Chat Application <= 5.0 SP4
Severity:

    Usage of weak Weak Session management exists within the Zeacom web-chat application 
    enabling the bruteforce of the sessionid which can enable the hijacking of anothers chat session. 
    The Zeacom application handles new sessions through a 10 character string &#40;JSESSIONID&#41;, 
    resulting in an effective 9 bit entropy level for session management. The end result of an 
    attack would enable an attacker to hijack a session where private information is revealed 
    within a chat session or a denial of service within the application server resulting in 
    a complete crash of the application server. &#40;Tomcat&#41;
    
    In most scenarios the application would crash locking the application server. 

    Risk:  Medium

Vendor Status: Zeacom
Vulnerability Reference: CVE-2010-0217

http://www.packetninjas.net/storage/advisories/Zeacom-CVE-2010-0217.txt

Overview:
Information provided from http://www.zeacom.com

"Zeacom is a leading provider of advanced Unified Communications solutions that integrate
real-time communication tools such as presence information, contact routing, conferencing,
chat and speech recognition with conventional tools such as voicemail, email and fax."

During evaluation of a blackbox application assessment routine
application security checks were performed to test the strength of session
management within the Zeacom Chat application.

The Zeacom application handles new sessions through a 10 character string which
is a part of the JSESSIONID, which results in an effective 9 bit entropy level
for session management.

Proof of Concept:

By looking at the JSESSIONID, one is able to determine that it is trivial to brute force the session
id (JSESSIONID) space.

Disclosure Timeline:
April 1st, 2010 - Initial Contact with Zeacom.
April 6th, 2010 - Zeacom acknowledges the receipt of the initial communication.
April 20th, 2010 - Zeacom acknowledges that the version of Zeacom Chat server affected is <= 5.0 SP4.
- Zeacom also states that they will not be issuing a patch for customers running <= 5.0SP4
but will be moving clients to their new 5.1 release.

Recommendation: