bugmldonkey, a multi-networks file-sharing client - Bugs: bug #11185, Passwords stored insecurely

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #11185: Passwords stored insecurely

Submitter:  None
Submitted:  Wed 01 Dec 2004 04:58:06 PM UTC
   
 
Category:  Core Severity:  3 - Normal
Item Group:  Program malfunction Status:  Fixed
Assigned to:  None Open/Closed:  Closed
Release:  None Release: 
Operating System:  None Binaries Origin:  None
CPU type:  None

Sat 23 Apr 2005 10:16:48 PM UTC, comment #3: 

Applied 2.5.30.9

spiralvoice <spiralvoice>
Group administrator
Sat 23 Apr 2005 09:06:57 PM UTC, comment #2: 

Patch was applied in svn revision 278 .

Amorphous <amorphous>
Mon 18 Apr 2005 07:14:19 PM UTC, comment #1: 

I submitted patch #3919, please test if it works.

spiralvoice <spiralvoice>
Group administrator
Wed 01 Dec 2004 04:58:06 PM UTC, original submission:  

mldonkey stores its access passwords in downloads.ini, which is typically world-readable. Since the file is not overwritten but moved and recreated every time it's saved, permissions will not be preserved; the only way to protect password hashes is to make the whole working directory inaccessible or to set the umask for the mldonkey process. Both of these are undesirable, since users may want to allow others access to downloaded files, etc. (Especially true if you run mlnet process under a uid separate from your own uid!)

The solution is to use 0600 rather than 0666 as the file creation mode for downloads.ini, or move the passwords to a separate file that's given restricted permissions so that the other info in downloads.ini can be left world-readable.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by spiralvoice
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2005-04-27 spiralvoice Open/ClosedOpen Closed
    2005-04-23 amorphous StatusNone Fixed
    2005-04-18 spiralvoice Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code