Description
The login protocol in RealChat 3.5.1b does not use authentication, which allows remote attackers to log on as other users by sniffing the beginning of a chat session and replaying it via a modified username.
References
- 14358 vdb-entry
- 20050723 Realchat user impersonation - BSA 200506110001 mailing-list
- realchat-account-login(21497) vdb-entry
- 1014562 vdb-entry