bugmldonkey, a multi-networks file-sharing client - Bugs: bug #12376, Gaping security hole (GIFT gui...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #12376: Gaping security hole (GIFT gui support)

Submitter:  None
Submitted:  Sat 19 Mar 2005 07:21:17 PM UTC
   
 
Category:  Core Severity:  3 - Normal
Item Group:  Program malfunction Status:  Fixed
Assigned to:  None Open/Closed:  Closed
Release:  None Release:  all
Operating System:  None Binaries Origin:  None
CPU type:  None

Jump to the original submission

Mon 27 Feb 2006 03:22:44 AM UTC, comment #7: 

posted a working version of pangos patch in patch #4930,
no need to remove giFT GUI support anymore

spiralvoice <spiralvoice>
Group administrator
Tue 21 Feb 2006 09:40:33 AM UTC, comment #6: 

Oups, I missed the "no authentication" part :/
What about requiring "profile" to contain "user:password" ?

(Untested patch attached)

pango <mlpango>
Group Member
Tue 21 Feb 2006 09:08:53 AM UTC, comment #5: 

GiFT interface has been limited by !!allowed_ips from the start:
http://cvs.savannah.nongnu.org/viewcvs/mldonkey/src/daemon/driver/driverInterface.ml?root=mldonkey&r1=1.7&r2=1.7.4.1

And explain why it's not sufficient.

pango <mlpango>
Group Member
Thu 25 Aug 2005 08:23:40 PM UTC, comment #4: 

I checked my client (2.6.3), and it is using the OLD default gift port setting, therefore it is vulnerable to this security hole. I presume that many or most clients would behave the same way upon an upgrade, which leaves them insecure, regardless of the new default to disable it.
I may also have manually set the port at some point, I do not remember.

Anonymous
Wed 30 Mar 2005 04:12:47 PM UTC, comment #3: 

Just some additional info.
The giFT Project is moving away from this interface.
Comment from gift.sf.net:
"why won't this thing just die!?"

mwarning <mwarning>
Sat 19 Mar 2005 10:21:05 PM UTC, comment #2: 

that's why the port is set to 0 per default in 2.5.30ab . 0 disables that port.

Amorphous <amorphous>
Sat 19 Mar 2005 09:39:10 PM UTC, comment #1: 


Never dealt with Gift port, nor with the gift itself ... since gift is a different project, there is probably a problem implementing any type of authentication. Both sides would need to implement such a thing.

Just a short question ... aren't connections to the gift port at least checked against allowed_ips?
(I know, that this is not realy sufficent ...)

Anonymous
Sat 19 Mar 2005 07:21:17 PM UTC, original submission:  

GIFT port is open by default and does not have any authentication mechanism. Anyone with the ability to connect to this port can obtain control over the core. This is a huge gaping security hole. Please fix asap.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 9 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2006-02-27 spiralvoice StatusNone Fixed
    Open/ClosedOpen Closed
2006-02-27 spiralvoice Attached File#3429 Removed
2006-02-21 mlpango Attached File- Added gift_gui_authentication.patch, #3430
2006-02-21 mlpango Open/ClosedClosed Open
    SummaryRemove Gift GUI support Gaping security hole (GIFT gui support)
2006-02-21 spiralvoice Reassign ItemFrom group mldonkey, a multi-networks file-sharing client, bugs tracker To group mldonkey, a multi-networks file-sharing client, patch tracker
2006-02-21 spiralvoice SummaryGaping security hole (GIFT gui support) Remove Gift GUI support
    Attached File- Added gift_remove.patch, #3429

Back to the top

Powered by Savane 3.13-02a9.
Corresponding source code