In association with heise online

« previous | next »

16 March 2009, 13:41

MLDonkey 3.0 closes security hole

The MLDonkey file sharing program has a security hole which allows access to arbitrary files on a system. The P2P program's web based management interface, which typically runs on TCP port 4080, does not properly filter requests. This means you can insert a double slash into a query like so

     http://mlhost:4080//etc/passwd

and the server will return the contents of /etc/passwd. The bug is fixed in version 3.0 and affected Linux distributions are already issuing updated packages.

See also:

Http double slash request arbitrary file access vulnerability, bug report from MLDonkey.
MLDonkey:New Release 3.0.0, release announcement.

« previous | next »

Print Version | Send by email | Permalink: http://h-online.com/-740577

Also on The H: