bugmldonkey, a multi-networks file-sharing client - Bugs: bug #492, Potential security problem -...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #492: Potential security problem - mldonkey creating subdirectories.

Submitted by:  None
Submitted on:  Wed 29 May 2002 12:02:08 AM UTC  
 
Category: CoreSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Assigned to: mldonkey admin <mldonkey>Open/Closed: Closed
Release: Release: None
Operating System: NoneBinaries Origin: None
CPU type: None

Sun 04 Aug 2002 11:34:43 AM UTC, comment #3:

Using a filename like the next:

Expediente-X 2x18 Temible Simetria [DVDRiP][Spanish Divx] cifirip].avi

It will make a directory with the part of the name, and will include the rest of the file (in linux at least).

Regards,
Carlos.

Anonymous
Wed 29 May 2002 11:58:39 AM UTC, comment #2:

>I don't think this is a security hole, btw if you run mldonkey as root it's your own fault ;)


Yes, i know. But i'm using it on a fli4l router system, and don't have much of a choice. I think i'll bring it up at the fli4l newsgroup or so.

>If you think it could write somewhere in the users home dir run it in a chroot environment.


Yes, chroot is of course the best security measure. But i don't think that there is a reason why mldonkey should be able to create directories in the first place.. should be quite easy to fix, too.

Anonymous
Wed 29 May 2002 04:07:24 AM UTC, comment #1:

I don't think this is a security hole, btw if you run mldonkey as root it's your own fault ;)
If you think it could write somewhere in the users home dir run it in a chroot environment.

Anonymous
Wed 29 May 2002 12:02:08 AM UTC, original submission:

Hi!

I'm not sure if i just found a potential security threat in mlDonkey 1.16. I have written another description of the problem to one of the developers (including hashes for the file), because i don't wanted to post hashes/and or filenames.

I just finished some download and commited the files using the "commit" command. This was the filename as it was shown in the web-interface:

Downloaded 2 files [ Num ] File Size MD4
[3 ] some-scvd.bin 800000000 SOME_LENGTHY_MD4_CHECKSUM
..

After commiting, i looked into the incoming directory, and noticed that mldonkey created a subdirectory, containing a single file:

fli4l:/mnt/hda4/incoming/ed2k # tree
.
|-- Some_subdirectory_created_by_mldonkey_after_committing
`-- somebinfile.bin
1 directory, 1 files

So mldonkey seems to have created a subdirectory named "Some_subdirectory_created_by_mldonkey_after_committing", containing a single file "somebinfile.bin".

Is this the wanted behaviour? I'm afraid that this could be a potential security threat, if the file would have been written to something like "/root/i0wnzY0" or something like that..

I'm going to post this mail to the bug tracking forum, too (but without real filenames and hashes).

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 4 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 16 Sep 2002 07:28:35 PM UTCmldonkeyCategoryNone=>(Error - Not Found)
  StatusNone=>(Error - Not Found)
  Assigned toNone=>NA
  Open/ClosedOpen=>(Error - Not Found)

Back to the top


Powered by Savane 3.1-cleanup1