mldonkey, a multi-networks file-sharing client - Patches: patch #6754, Fix local file access bug in...

Group

Main
- Main
- View members
- Search
Homepage
Download
Mailing lists
Source code
Bugs
- ~~Submit new~~
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Tasks
- ~~Submit new~~
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Patches
- ~~Submit new~~
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
News
- Browse
- Atom feed
- ~~Submit~~
- ~~Manage~~

You are not allowed to post comments on this tracker with your current authentication level.

patch #6754: Fix local file access bug in internal http server

Submitter:	kyak <kyak>
Submitted:	Tue 24 Feb 2009 06:30:44 PM UTC


Category:	None	Priority:	9 - Immediate
Status:	Done	Assigned to:	None
Open/Closed:	Closed

Jump to the original submission

Tue 24 Feb 2009 07:22:39 PM UTC, comment #6: Committed file #17524 to prevent http://mldonkey:4080/downloads.ini download	spiralvoice <spiralvoice>
Tue 24 Feb 2009 06:38:44 PM UTC, comment #5: Committed 2009/02/24	spiralvoice <spiralvoice>
Tue 24 Feb 2009 06:30:44 PM UTC, comment #4: This item has been reassigned from the project mldonkey, a multi-networks file-sharing client bugs tracker to your tracker. The original report is still available at bugs #25667 Following are the information included in the original report: [field #0] Item ID: 25667 [field #1] Group ID: 1409 [field #2] Open/Closed: Open [field #3] Severity: 6 - Security [field #4] Privacy: Public [field #8] : Unknown bugs Field Display Type [field #9] Category: HTTP interface [field #10] Submitted by: kyak [field #11] Assigned to: spiralvoice [field #12] Submitted on: So 22 Feb 2009 09:55:40 CET [field #13] Summary: Http double slash request arbitrary file access vulnerability [field #14] Original Submission: I can access http://myip:4080//etc/passwd from my browser. Actually, i can access any file, readable by mldonkey, i just need to put a double slash before the name. It looks like a thttpd double slash request arbitrary file access vulnerability CVE-1999-1456. I am astonished that this has been staying undetected and unfixed for such a long time. [field #16] Item Group: Program malfunction [field #17] Status: Ready For Test [field #18] Component Version: None [field #19] Operating System: Linux [field #20] Reproducibility: None [field #21] Size (loc): None [field #22] Fixed Release: None [field #23] Planned Release: None [field #24] Effort: 0.00 [field #28] Priority: 5 - Normal [field #31] Percent Complete: 0% [field #33] Release: 2.9.7 [field #34] Release: 2.9.7 [field #58] Binaries Origin: CVS / Self compiled [field #59] CPU type: Intel x86 [field #60] CPU: None [field #61] Custom Select Box #4: None [field #62] Custom Select Box #5: None [field #63] Custom Select Box #6: None [field #64] Custom Select Box #7: None [field #65] Custom Select Box #8: None [field #66] Custom Select Box #9: None [field #67] Custom Select Box #10: None	spiralvoice <spiralvoice>
Tue 24 Feb 2009 06:30:32 PM UTC, comment #3: For the record, this bug was caused by patch #5787, committed 2007/03/08 to CVS and first released in MLDonkey 2.8.4. That bad patch can be found around line 1493 in http://cvs.savannah.gnu.org/viewvc/mldonkey/mldonkey/src/daemon/driver/driverControlers.ml?r1=1.96&r2=1.97	spiralvoice <spiralvoice>
Mon 23 Feb 2009 06:30:09 PM UTC, comment #2: please test the attached patch (file #17518)	spiralvoice <spiralvoice>
Mon 23 Feb 2009 08:29:47 AM UTC, comment #1: I was expecting, that reaction would be fast. Don't you guys believe that this is a strong security issue?	kyak <kyak>
Tue 24 Feb 2009 06:30:44 PM UTC, original submission: I can access http://myip:4080//etc/passwd from my browser. Actually, i can access any file, readable by mldonkey, i just need to put a double slash before the name. It looks like a thttpd double slash request arbitrary file access vulnerability CVE-1999-1456. I am astonished that this has been staying undetected and unfixed for such a long time.	kyak <kyak>

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files

file #17524: 6754_2.patch added by spiralvoice (2KiB - text/plain - committed this additional patch to prevent http://mldonkey:4080/downloads.ini download)

file #17518: url_slashes.patch added by spiralvoice (899B - application/force-download)

Depends on the following items: None found

Items that depend on this one: None found

Carbon-Copy List

-email is unavailable- added by spiralvoice (Updated the item)

-email is unavailable- added by kyak (Submitted the item)

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Follow 6 latest changes.

Date	Changed by	Updated Field	Previous Value	Replaced by
2009-02-24	spiralvoice	Attached File	-	Added 6754_2.patch, #17524
2009-02-24	spiralvoice	Priority	5 - Normal	9 - Immediate
		Status	None	Done
		Open/Closed	Open	Closed
		Summary	Http double slash request arbitrary file access vulnerability	Fix local file access bug in internal http server
2009-02-24	spiralvoice	Reassign item	mldonkey, a multi-networks file-sharing client, bug #25667	mldonkey, a multi-networks file-sharing client, patch #6754

mldonkey, a multi-networks file-sharing client - Patches: patch #6754, Fix local file access bug in...

patch #6754: Fix local file access bug in internal http server

<a href="#discussion">Discussion</a>

<a href="#attached">Attached Files</a>

<a href="#dependencies">Dependencies</a>

<a href="#cc">Mail Notification Carbon-Copy List</a>

<a href="#votes">Votes</a>

<a href="#history">History</a>