patchmldonkey, a multi-networks file-sharing client - Patches: patch #6754, Fix local file access bug in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #6754: Fix local file access bug in internal http server

Submitter:  kyak <kyak>
Submitted:  Tue 24 Feb 2009 06:30:44 PM UTC
   
 
Category:  None Priority:  9 - Immediate
Status:  Done Assigned to:  None
Open/Closed:  Closed

Jump to the original submission

Tue 24 Feb 2009 07:22:39 PM UTC, comment #6: 

Committed file #17524 to prevent http://mldonkey:4080/downloads.ini download

spiralvoice <spiralvoice>
Group administrator
Tue 24 Feb 2009 06:38:44 PM UTC, comment #5: 

Committed 2009/02/24

spiralvoice <spiralvoice>
Group administrator
Tue 24 Feb 2009 06:30:44 PM UTC, comment #4: 

This item has been reassigned from the project mldonkey, a multi-networks file-sharing client bugs tracker to your tracker.

The original report is still available at bugs #25667

Following are the information included in the original report:

[field #0]                  Item ID: 25667
[field #1]                 Group ID: 1409
[field #2]              Open/Closed: Open
[field #3]                 Severity: 6 - Security
[field #4]                  Privacy: Public
[field #8]                         : Unknown bugs Field Display Type
[field #9]                 Category: HTTP interface
[field #10]             Submitted by: kyak
[field #11]              Assigned to: spiralvoice
[field #12]             Submitted on: So 22 Feb 2009 09:55:40 CET
[field #13]                  Summary: Http double slash request arbitrary file access vulnerability
[field #14]      Original Submission: I can access http://myip:4080//etc/passwd from my browser.

Actually, i can access any file, readable by mldonkey, i just need to put a double slash before the name.

It looks like a thttpd double slash request arbitrary file access
vulnerability CVE-1999-1456.

I am astonished that this has been staying undetected and unfixed for such a long time.
[field #16]               Item Group: Program malfunction
[field #17]                   Status: Ready For Test
[field #18]        Component Version: None
[field #19]         Operating System: Linux
[field #20]          Reproducibility: None
[field #21]               Size (loc): None
[field #22]            Fixed Release: None
[field #23]          Planned Release: None
[field #24]                   Effort: 0.00
[field #28]                 Priority: 5 - Normal
[field #31]         Percent Complete: 0%
[field #33]                  Release: 2.9.7
[field #34]                  Release: 2.9.7
[field #58]          Binaries Origin: CVS / Self compiled
[field #59]                 CPU type: Intel x86
[field #60]                      CPU: None
[field #61]     Custom Select Box #4: None
[field #62]     Custom Select Box #5: None
[field #63]     Custom Select Box #6: None
[field #64]     Custom Select Box #7: None
[field #65]     Custom Select Box #8: None
[field #66]     Custom Select Box #9: None
[field #67]    Custom Select Box #10: None

spiralvoice <spiralvoice>
Group administrator
Tue 24 Feb 2009 06:30:32 PM UTC, comment #3: 

For the record, this bug was caused by patch #5787, committed
2007/03/08 to CVS and first released in MLDonkey 2.8.4.

That bad patch can be found around line 1493 in
http://cvs.savannah.gnu.org/viewvc/mldonkey/mldonkey/src/daemon/driver/driverControlers.ml?r1=1.96&r2=1.97

spiralvoice <spiralvoice>
Group administrator
Mon 23 Feb 2009 06:30:09 PM UTC, comment #2: 

please test the attached patch

(file #17518)

spiralvoice <spiralvoice>
Group administrator
Mon 23 Feb 2009 08:29:47 AM UTC, comment #1: 

I was expecting, that reaction would be fast. Don't you guys believe that this is a strong security issue?

kyak <kyak>
Tue 24 Feb 2009 06:30:44 PM UTC, original submission:  

I can access http://myip:4080//etc/passwd from my browser.

Actually, i can access any file, readable by mldonkey, i just need to put a double slash before the name.

It looks like a thttpd double slash request arbitrary file access
vulnerability CVE-1999-1456.

I am astonished that this has been staying undetected and unfixed for such a long time.

kyak <kyak>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #17524:  6754_2.patch added by spiralvoice (2KiB - text/plain - committed this additional patch to prevent http://mldonkey:4080/downloads.ini download)
file #17518:  url_slashes.patch added by spiralvoice (899B - application/force-download)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by spiralvoice (Updated the item)
  • -email is unavailable- added by kyak (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-02-24 spiralvoice Attached File- Added 6754_2.patch, #17524
    2009-02-24 spiralvoice Priority5 - Normal 9 - Immediate
        StatusNone Done
        Open/ClosedOpen Closed
        SummaryHttp double slash request arbitrary file access vulnerability Fix local file access bug in internal http server
    2009-02-24 spiralvoice Reassign itemmldonkey, a multi-networks file-sharing client, bug #25667 mldonkey, a multi-networks file-sharing client, patch #6754

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code