bugmldonkey, a multi-networks file-sharing client - Bugs: bug #25667, Reassigned to another tracker...


You are not allowed to post comments on this tracker with your current authentication level.

bug #25667: Reassigned to another tracker [was: Http double slash request arbitrary file access vulnerability]

Submitted by:  kyak <kyak>
Submitted on:  Sun Feb 22 08:55:40 2009  
Category: HTTP interfaceSeverity: 6 - Security
Item Group: Program malfunctionStatus: Ready For Test
Assigned to: spiralvoice <spiralvoice>Open/Closed: Closed
Release: 2.9.7Release: 2.9.7
Operating System: LinuxBinaries Origin: CVS / Self compiled
CPU type: Intel x86

Tue Feb 24 18:30:44 2009, comment #4:


Please, do not post any new comments to this item.

spiralvoice <spiralvoice>
Project AdministratorIn charge of this item.
Tue Feb 24 18:30:32 2009, comment #3:

For the record, this bug was caused by patch #5787, committed
2007/03/08 to CVS and first released in MLDonkey 2.8.4.

That bad patch can be found around line 1493 in

spiralvoice <spiralvoice>
Project AdministratorIn charge of this item.
Mon Feb 23 18:30:09 2009, comment #2:

please test the attached patch

(file #17518)

spiralvoice <spiralvoice>
Project AdministratorIn charge of this item.
Mon Feb 23 08:29:47 2009, comment #1:

I was expecting, that reaction would be fast. Don't you guys believe that this is a strong security issue?

kyak <kyak>
Sun Feb 22 08:55:40 2009, original submission:

I can access http://myip:4080//etc/passwd from my browser.

Actually, i can access any file, readable by mldonkey, i just need to put a double slash before the name.

It looks like a thttpd double slash request arbitrary file access
vulnerability CVE-1999-1456.

I am astonished that this has been staying undetected and unfixed for such a long time.

kyak <kyak>


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by spiralvoice (Updated the item)
  • -unavailable- added by kyak (Submitted the item)

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue Feb 24 18:30:44 2009spiralvoiceReassign Itemmldonkey, a multi-networks file-sharing client, bug #25667=>mldonkey, a multi-networks file-sharing client, patch #6754
    Mon Feb 23 18:30:58 2009spiralvoiceSeverity3 - Normal=>6 - Security
      StatusNone=>Ready For Test
      Assigned toNone=>spiralvoice
    Mon Feb 23 18:30:09 2009spiralvoiceAttached File-=>Added url_slashes.patch, #17518
    Sun Feb 22 08:57:17 2009kyakCarbon-CopyRemoved kyak=>-
    Sun Feb 22 08:55:40 2009kyakCarbon-Copy-=>Added kyak

    Back to the top

    Powered by Savane 3.1-cleanup1