bugmldonkey, a multi-networks file-sharing client - Bugs: bug #25667, Reassigned to another tracker...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #25667: Reassigned to another tracker [was: Http double slash request arbitrary file access vulnerability]

Submitter:  kyak <kyak>
Submitted:  Sun 22 Feb 2009 08:55:40 AM UTC
   
 
Category:  HTTP interface Severity:  6 - Security
Priority:  5 - Normal Item Group:  Program malfunction
Status:  Ready For Test Assigned to:  spiralvoice
Open/Closed:  Closed Release:  2.9.7
Release:  2.9.7 Operating System:  Linux
Binaries Origin:  CVS / Self compiled CPU type:  Intel x86

Discussion

Tue 24 Feb 2009 06:30:44 PM UTC, comment #4: 

THIS ITEM WAS REASSIGNED TO PATCH #6754


Please, do not post any new comments to this item.

spiralvoice <spiralvoice>
Group administrator
Tue 24 Feb 2009 06:30:32 PM UTC, comment #3: 

For the record, this bug was caused by patch #5787, committed
2007/03/08 to CVS and first released in MLDonkey 2.8.4.

That bad patch can be found around line 1493 in
http://cvs.savann ... =1.96&r2=1.97

spiralvoice <spiralvoice>
Group administrator
Mon 23 Feb 2009 06:30:09 PM UTC, comment #2: 

please test the attached patch

(file #17518)

spiralvoice <spiralvoice>
Group administrator
Mon 23 Feb 2009 08:29:47 AM UTC, comment #1: 

I was expecting, that reaction would be fast. Don't you guys believe that this is a strong security issue?

kyak <kyak>
Sun 22 Feb 2009 08:55:40 AM UTC, original submission:  

THIS ITEM WAS REASSIGNED TO PATCH #6754
I can access http://myip:4 ... 0//etc/passwd from my browser.

Actually, i can access any file, readable by mldonkey, i just need to put a double slash before the name.

It looks like a thttpd double slash request arbitrary file access
vulnerability CVE-1999-1456.

I am astonished that this has been staying undetected and unfixed for such a long time.

kyak <kyak>

 

Attached Files

This item currently has no attached files.

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by spiralvoice (Updated the item)
  • -email is unavailable- added by kyak (Submitted the item)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    History

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-02-24 spiralvoice Reassign Itemmldonkey, a multi-networks file-sharing client, bug #25667 mldonkey, a multi-networks file-sharing client, patch #6754
    2009-02-23 spiralvoice Severity3 - Normal 6 - Security
        StatusNone Ready For Test
        Assigned toNone spiralvoice
    2009-02-23 spiralvoice Attached File- Added url_slashes.patch, #17518
    2009-02-22 kyak Carbon-CopyRemoved kyak -
    2009-02-22 kyak Carbon-Copy- Added kyak

    Back to the top

    Powered by Savane 3.16.
    Corresponding source code