patchmldonkey, a multi-networks file-sharing client - Patches: patch #4930, giFT GUI: Authentication support

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #4930: giFT GUI: Authentication support

Submitter:  None
Submitted:  Tue 21 Feb 2006 09:05:03 AM UTC
   
 
Category:  None Priority:  5 - Normal
Status:  Done Assigned to:  None
Originator Email:  -email is unavailable- Open/Closed:  Closed

Jump to the original submission

Wed 01 Mar 2006 08:05:18 PM UTC, comment #7: 

Applied 2006/03/01

spiralvoice <spiralvoice>
Group administrator
Mon 27 Feb 2006 03:21:47 AM UTC, comment #6: 

based on pangos patch
https://savannah.nongnu.org/bugs/?func=detailitem&item_id=12376#comment6
here is a new, working version.

Logging in with giFTcurs now has to be done like this:
giFTcurs -p user:password

spiralvoice <spiralvoice>
Group administrator
Tue 21 Feb 2006 09:05:03 AM UTC, comment #5: 

This item has been reassigned from the project mldonkey, a multi-networks file-sharing client bugs tracker to your tracker.

The original report is still available at bugs #12376

Following are the information included in the original report:

[field #0]                  Item ID: 12376
[field #1]                 Group ID: 1409
[field #2]              Open/Closed: Open
[field #3]                 Severity: 3 - Normal
[field #4]                  Privacy: Public
[field #6]                 Category: Core
[field #7]             Submitted by: None
[field #8]              Assigned to: None
[field #9]             Submitted on: Sa 19.03.2005 um 20:21
[field #10]                  Summary: Remove Gift GUI support
[field #11]      Original Submission: GIFT port is open by default and does not have any authentication mechanism. Anyone with the ability to connect to this port can obtain control over the core. This is a huge gaping security hole. Please fix asap.
[field #13]               Item Group: Program malfunction
[field #14]                   Status: None
[field #15]        Component Version: None
[field #16]         Platform Version: None
[field #17]          Reproducibility: None
[field #18]               Size (loc): None
[field #19]            Fixed Release: None
[field #20]          Planned Release: None
[field #21]                   Effort: 0.00
[field #25]                 Priority: 5 - Normal
[field #28]         Percent Complete: 0%
[field #30]                  Release: None
[field #31]                  Release: all
[field #55]          Binaries Origin: None
[field #56]                 CPU type: None
[field #57]                      CPU: None
[field #58]     Custom Select Box #4: None
[field #59]     Custom Select Box #5: None
[field #60]     Custom Select Box #6: None
[field #61]     Custom Select Box #7: None
[field #62]     Custom Select Box #8: None
[field #63]     Custom Select Box #9: None
[field #64]    Custom Select Box #10: None

spiralvoice <spiralvoice>
Group administrator
Thu 25 Aug 2005 08:23:40 PM UTC, comment #4: 

I checked my client (2.6.3), and it is using the OLD default gift port setting, therefore it is vulnerable to this security hole. I presume that many or most clients would behave the same way upon an upgrade, which leaves them insecure, regardless of the new default to disable it.
I may also have manually set the port at some point, I do not remember.

Anonymous
Wed 30 Mar 2005 04:12:47 PM UTC, comment #3: 

Just some additional info.
The giFT Project is moving away from this interface.
Comment from gift.sf.net:
"why won't this thing just die!?"

mwarning <mwarning>
Sat 19 Mar 2005 10:21:05 PM UTC, comment #2: 

that's why the port is set to 0 per default in 2.5.30ab . 0 disables that port.

Amorphous <amorphous>
Sat 19 Mar 2005 09:39:10 PM UTC, comment #1: 


Never dealt with Gift port, nor with the gift itself ... since gift is a different project, there is probably a problem implementing any type of authentication. Both sides would need to implement such a thing.

Just a short question ... aren't connections to the gift port at least checked against allowed_ips?
(I know, that this is not realy sufficent ...)

Anonymous
Tue 21 Feb 2006 09:05:03 AM UTC, original submission:  

GIFT port is open by default and does not have any authentication mechanism. Anyone with the ability to connect to this port can obtain control over the core. This is a huge gaping security hole. Please fix asap.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #9639:  gift_gui_authentication.patch added by spiralvoice (1KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 7 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2006-03-01 spiralvoice StatusNone Done
    Open/ClosedOpen Closed
2006-02-27 spiralvoice Attached File#5977 Removed
2006-02-27 spiralvoice SummaryRemove Gift GUI support giFT GUI: Authentication support
    Attached File- Added gift_gui_authentication.patch, #5992
2006-02-21 spiralvoice SummaryReassigned item: Remove Gift GUI support Remove Gift GUI support
2006-02-21 spiralvoice Reassign itemFrom group mldonkey, a multi-networks file-sharing client, bugs tracker To group mldonkey, a multi-networks file-sharing client, patch tracker

Back to the top

Powered by Savane 3.13-bb6a.
Corresponding source code