MLDonkey 3.0 closes security hole

The MLDonkey file sharing program has a security hole which allows access to arbitrary files on a system. The P2P program's web based management interface, which typically runs on TCP port 4080, does not properly filter requests. This means you can insert a double slash into a query like so

     http://mlhost:4080//etc/passwd

and the server will return the contents of /etc/passwd. The bug is fixed in version 3.0 and affected Linux distributions are already issuing updated packages.

See also:

• Http double slash request arbitrary file access vulnerability, bug report from MLDonkey.
• MLDonkey:New Release 3.0.0, release announcement.

(djwm)