CVE-2004-1586

Vulnerability

The Flash Messaging Server version 5.2.0g (rev 1.1.2) and earlier fails to enforce disconnection commands such as "shutdown" sent to clients. The server sends these commands as wide-character strings, but clients can ignore them and remain connected without the server terminating the session. This vulnerability is present in the network protocol handling of the server and does not require any special configuration to be reachable [1].

Exploitation

An attacker can exploit this by using a modified or custom client that disregards the shutdown command from the server. No authentication or special network position is required beyond being a legitimate client connected to the server. The attacker simply connects to the server using a client that does not honor the shutdown command, and the server will not forcibly disconnect them [1].

Impact

A successful attack allows the attacker to maintain a persistent connection to the Flash Messaging Server even when the server administrator attempts to shut down the client. This could lead to unauthorized continued access to messaging services, potentially enabling further abuse such as spamming or disruption of server operations. The impact is limited to the ability to stay connected; there is no indication of data disclosure or code execution [1].

Mitigation

As of the publication date (2004-10-07), no official fix was available. Users were advised to upgrade to a version newer than 5.2.0g if available, or to implement network-level controls to block or monitor persistent connections. The vendor's response or a patched version is not disclosed in the available references [1].