bugmldonkey, a multi-networks file-sharing client - Bugs: bug #25667, Reassigned to another tracker...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #25667: Reassigned to another tracker [was: Http double slash request arbitrary file access vulnerability]

Submitter:  kyak <kyak>
Submitted:  Sun 22 Feb 2009 08:55:40 AM UTC
   
 
Category:  HTTP interface Severity:  6 - Security
Item Group:  Program malfunction Status:  Ready For Test
Assigned to:  spiralvoice Open/Closed:  Closed
Release:  2.9.7 Release:  2.9.7
Operating System:  Linux Binaries Origin:  CVS / Self compiled
CPU type:  Intel x86

Tue 24 Feb 2009 06:30:44 PM UTC, comment #4: 

THIS ITEM WAS REASSIGNED TO PATCH #6754


Please, do not post any new comments to this item.

spiralvoice <spiralvoice>
Group administrator
Tue 24 Feb 2009 06:30:32 PM UTC, comment #3: 

For the record, this bug was caused by patch #5787, committed
2007/03/08 to CVS and first released in MLDonkey 2.8.4.

That bad patch can be found around line 1493 in
http://cvs.savannah.gnu.org/viewvc/mldonkey/mldonkey/src/daemon/driver/driverControlers.ml?r1=1.96&r2=1.97

spiralvoice <spiralvoice>
Group administrator
Mon 23 Feb 2009 06:30:09 PM UTC, comment #2: 

please test the attached patch

(file #17518)

spiralvoice <spiralvoice>
Group administrator
Mon 23 Feb 2009 08:29:47 AM UTC, comment #1: 

I was expecting, that reaction would be fast. Don't you guys believe that this is a strong security issue?

kyak <kyak>
Sun 22 Feb 2009 08:55:40 AM UTC, original submission:  

THIS ITEM WAS REASSIGNED TO PATCH #6754
I can access http://myip:4080//etc/passwd from my browser.

Actually, i can access any file, readable by mldonkey, i just need to put a double slash before the name.

It looks like a thttpd double slash request arbitrary file access
vulnerability CVE-1999-1456.

I am astonished that this has been staying undetected and unfixed for such a long time.

kyak <kyak>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by spiralvoice (Updated the item)
  • -email is unavailable- added by kyak (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-02-24 spiralvoice Reassign Itemmldonkey, a multi-networks file-sharing client, bug #25667 mldonkey, a multi-networks file-sharing client, patch #6754
    2009-02-23 spiralvoice Severity3 - Normal 6 - Security
        StatusNone Ready For Test
        Assigned toNone spiralvoice
    2009-02-23 spiralvoice Attached File- Added url_slashes.patch, #17518
    2009-02-22 kyak Carbon-CopyRemoved kyak -
    2009-02-22 kyak Carbon-Copy- Added kyak

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code