bugmldonkey, a multi-networks file-sharing client - Bugs: bug #12376, Gaping security hole (GIFT gui...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #12376: Gaping security hole (GIFT gui support)

Submitted by:  None
Submitted on:  Sat 19 Mar 2005 07:21:17 PM UTC  
 
Category: CoreSeverity: 3 - Normal
Item Group: Program malfunctionStatus: Fixed
Assigned to: NoneOpen/Closed: Closed
Release: allRelease: None
Operating System: NoneBinaries Origin: None
CPU type: None

(Jump to the original submission Jump to the original submission)

Mon 27 Feb 2006 03:22:44 AM UTC, comment #7:

posted a working version of pangos patch in patch #4930,
no need to remove giFT GUI support anymore

spiralvoice <spiralvoice>
Project Administrator
Tue 21 Feb 2006 09:40:33 AM UTC, comment #6:

Oups, I missed the "no authentication" part :/
What about requiring "profile" to contain "user:password" ?

(Untested patch attached)

pango <mlpango>
Project Member
Tue 21 Feb 2006 09:08:53 AM UTC, comment #5:

GiFT interface has been limited by !!allowed_ips from the start:
http://cvs.savannah.nongnu.org/viewcvs/mldonkey/src/daemon/driver/driverInterface.ml?root=mldonkey&r1=1.7&r2=1.7.4.1

And explain why it's not sufficient.

pango <mlpango>
Project Member
Thu 25 Aug 2005 08:23:40 PM UTC, comment #4:

I checked my client (2.6.3), and it is using the OLD default gift port setting, therefore it is vulnerable to this security hole. I presume that many or most clients would behave the same way upon an upgrade, which leaves them insecure, regardless of the new default to disable it.
I may also have manually set the port at some point, I do not remember.

Anonymous
Wed 30 Mar 2005 04:12:47 PM UTC, comment #3:

Just some additional info.
The giFT Project is moving away from this interface.
Comment from gift.sf.net:
"why won't this thing just die!?"

mwarning <mwarning>
Sat 19 Mar 2005 10:21:05 PM UTC, comment #2:

that's why the port is set to 0 per default in 2.5.30ab . 0 disables that port.

Amorphous <amorphous>
Sat 19 Mar 2005 09:39:10 PM UTC, comment #1:

Never dealt with Gift port, nor with the gift itself ... since gift is a different project, there is probably a problem implementing any type of authentication. Both sides would need to implement such a thing.

Just a short question ... aren't connections to the gift port at least checked against allowed_ips?
(I know, that this is not realy sufficent ...)

Anonymous
Sat 19 Mar 2005 07:21:17 PM UTC, original submission:

GIFT port is open by default and does not have any authentication mechanism. Anyone with the ability to connect to this port can obtain control over the core. This is a huge gaping security hole. Please fix asap.

Anonymous

 

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 9 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 27 Feb 2006 03:23:46 AM UTCspiralvoiceStatusNone=>Fixed
  Open/ClosedOpen=>Closed
Mon 27 Feb 2006 03:22:42 AM UTCspiralvoiceAttached File#3429=>Removed
Tue 21 Feb 2006 09:40:33 AM UTCmlpangoAttached File-=>Added gift_gui_authentication.patch, #3430
Tue 21 Feb 2006 09:08:53 AM UTCmlpangoOpen/ClosedClosed=>Open
  SummaryRemove Gift GUI support=>Gaping security hole (GIFT gui support)
Tue 21 Feb 2006 09:05:03 AM UTCspiralvoiceReassign ItemFrom group mldonkey, a multi-networks file-sharing client, bugs tracker=>To group mldonkey, a multi-networks file-sharing client, patch tracker
Tue 21 Feb 2006 09:05:02 AM UTCspiralvoiceSummaryGaping security hole (GIFT gui support)=>Remove Gift GUI support
  Attached File-=>Added gift_remove.patch, #3429

Back to the top


Powered by Savane 3.1-cleanup1