mldonkey, a multi-networks file-sharing client - Bugs: bug #12376, Gaping security hole (GIFT gui...
You are not allowed to post comments on this tracker with your current authentication level.
bug #12376: Gaping security hole (GIFT gui support)
Submitter: | None | ||
Submitted: | Sat 19 Mar 2005 07:21:17 PM UTC | ||
Category: | Core | Severity: | 3 - Normal |
Item Group: | Program malfunction | Status: | Fixed |
Assigned to: | None | Open/Closed: | Closed |
Release: | None | Release: | all |
Operating System: | None | Binaries Origin: | None |
CPU type: | None |
Jump to the original submission
Mon 27 Feb 2006 03:22:44 AM UTC, comment #7: |
spiralvoice <spiralvoice> |
Tue 21 Feb 2006 09:40:33 AM UTC, comment #6: Oups, I missed the "no authentication" part :/
|
pango <mlpango> |
Tue 21 Feb 2006 09:08:53 AM UTC, comment #5: GiFT interface has been limited by !!allowed_ips from the start:
|
pango <mlpango> |
Thu 25 Aug 2005 08:23:40 PM UTC, comment #4: I checked my client (2.6.3), and it is using the OLD default gift port setting, therefore it is vulnerable to this security hole. I presume that many or most clients would behave the same way upon an upgrade, which leaves them insecure, regardless of the new default to disable it.
|
Anonymous |
Wed 30 Mar 2005 04:12:47 PM UTC, comment #3: Just some additional info.
|
mwarning <mwarning> |
Sat 19 Mar 2005 10:21:05 PM UTC, comment #2: that's why the port is set to 0 per default in 2.5.30ab . 0 disables that port. |
Amorphous <amorphous> |
Sat 19 Mar 2005 09:39:10 PM UTC, comment #1:
|
Anonymous |
Sat 19 Mar 2005 07:21:17 PM UTC, original submission:
GIFT port is open by default and does not have any authentication mechanism. Anyone with the ability to connect to this port can obtain control over the core. This is a huge gaping security hole. Please fix asap. |
Anonymous |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2006-02-27 | spiralvoice | Status | None | Fixed | |
Open/Closed | Open | Closed | |||
2006-02-27 | spiralvoice | Attached File | #3429 | Removed | |
2006-02-21 | mlpango | Attached File | - | Added gift_gui_authentication.patch, #3430 | |
2006-02-21 | mlpango | Open/Closed | Closed | Open | |
Summary | Remove Gift GUI support | Gaping security hole (GIFT gui support) | |||
2006-02-21 | spiralvoice | Reassign Item | From group mldonkey, a multi-networks file-sharing client, bugs tracker | To group mldonkey, a multi-networks file-sharing client, patch tracker | |
2006-02-21 | spiralvoice | Summary | Gaping security hole (GIFT gui support) | Remove Gift GUI support | |
Attached File | - | Added gift_remove.patch, #3429 |
Powered by Savane 3.13-02a9.
Corresponding source code
posted a working version of pangos patch in patch #4930,
no need to remove giFT GUI support anymore