bugmldonkey, a multi-networks file-sharing client - Bugs: bug #11185, Passwords stored insecurely


You are not allowed to post comments on this tracker with your current authentication level.

bug #11185: Passwords stored insecurely

Submitted by:  None
Submitted on:  Wed 01 Dec 2004 04:58:06 PM UTC  
Category:  Core Severity:  3 - Normal
Item Group:  Program malfunction Status:  Fixed
Assigned to:  None Open/Closed:  Closed
Release:  Release:  None
Operating System:  None Binaries Origin:  None
CPU type:  None

Sat 23 Apr 2005 10:16:48 PM UTC, comment #3: 


spiralvoice <spiralvoice>
Project Administrator
Sat 23 Apr 2005 09:06:57 PM UTC, comment #2: 

Patch was applied in svn revision 278 .

Amorphous <amorphous>
Mon 18 Apr 2005 07:14:19 PM UTC, comment #1: 

I submitted patch #3919, please test if it works.

spiralvoice <spiralvoice>
Project Administrator
Wed 01 Dec 2004 04:58:06 PM UTC, original submission:  

mldonkey stores its access passwords in downloads.ini, which is typically world-readable. Since the file is not overwritten but moved and recreated every time it's saved, permissions will not be preserved; the only way to protect password hashes is to make the whole working directory inaccessible or to set the umask for the mldonkey process. Both of these are undesirable, since users may want to allow others access to downloaded files, etc. (Especially true if you run mlnet process under a uid separate from your own uid!)

The solution is to use 0600 rather than 0666 as the file creation mode for downloads.ini, or move the passwords to a separate file that's given restricted permissions so that the other info in downloads.ini can be left world-readable.



No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by spiralvoice

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2005-04-27 spiralvoice Open/ClosedOpen => Closed
    2005-04-23 amorphous StatusNone => Fixed
    2005-04-18 spiralvoice Carbon-Copy- => Added 300560@bugs.debian.org

    Back to the top

    Powered by Savane 3.6