16 March 2009, 13:41
MLDonkey 3.0 closes security hole
The MLDonkey file sharing program has a security hole which allows access to arbitrary files on a system. The P2P program's web based management interface, which typically runs on TCP port 4080, does not properly filter requests. This means you can insert a double slash into a query like so
http://mlhost:4080//etc/passwd
and the server will return the contents of /etc/passwd. The bug is fixed in version 3.0 and affected Linux distributions are already issuing updated packages.
See also:
- Http double slash request arbitrary file access vulnerability, bug report from MLDonkey.
- MLDonkey:New Release 3.0.0, release announcement.
(djwm)
