Bugtraq mailing list archives
Gnapster Vulnerability Compromises User-readable Files
From: earlyjp () CS PURDUE EDU (Jim Early)
Date: Wed, 10 May 2000 14:50:18 -0500
Gnapster Vulnerability Compromises User-readable Files This vulnerability was discovered at the Center for Education and Research in Information Assurance and Security (CERIAS) at Purdue University <http://www.cerias.purdue.edu> by: Tom Daniels <daniels () cerias purdue edu> Florian Buchholz <florian () cerias purdue edu> James Early <earlyjp () cs purdue edu> Environment: Intel PII-based System Linux RedHat Version 6.2 (may apply to all OS's running Gnapster) Gnapster Version 1.3.8 (and earlier) Gnapster is an open source, independent implementation of the Napster protocol client. Problem: It is possible for anyone to obtain any user-readable file by sending a properly formed "GET" command that contains the full path of the file. This vulnerability exists because Gnapster fails to check that the requested file is an explicitly shared MP3 file before providing it. Note: This is the same vulnerability described in FreeBSD-SA-00:18 Anyone running Gnapster version 1.3.8 or earlier is vulnerable. Given the IP address and TCP port of a vulnerable client, an attacker can send a request for an arbitrary file to the Gnapster client. If the user has read access to the file, the client will then respond with the contents of the file. Solution: We contacted the program's author, and he promptly created a new version which addresses this vulnerability. The fix simply checks that a requested file is in the list of shared files. The current version can be downloaded from: http://download.sourceforge.net/gnapster/gnapster-1.3.9.tar.gz Exploit: We have developed an exploit code for this vulnerability, but we will not be releasing it to the public. Conclusion: We have described a vulnerability in one client implementation of the Napster protocol. There may be similar problems in other implementations of the protocol as we have not done an exhaustive search. The official Windows client does not seem to be affected. We urge users to upgrade to the latest version of Gnapster.
Current thread:
- Re: RFP2K05: NetProwler vs. RFProwler, (continued)
- Re: RFP2K05: NetProwler vs. RFProwler Pedro Quintanilha (May 23)
- Security Vulnerability in Qpopper 2.53 (Upgrade to 3.0.2) Qpopper Support (May 23)
- Remote xploit for MDBMS |[TDP]| (May 24)
- HP Web JetAdmin Version 6.0 Remote DoS attack Vulnerability Ussr Labs (May 24)
- Re: RFP2K04: Mining BlackICE with RFPickAxe rain forest puppy (May 19)
- revised patches for kerberos vulnerability Tom Yu (May 19)
- Microsoft Security Bulletin (MS00-029) Microsoft Product Security (May 19)
- BindView Security Advisory: jolt2 - Remote DoS against NT, W2K, 9x BindView Security Advisory (May 19)
- Bugtraq Stats for the last 3 years available now. Alfred Huger (May 17)
- KNapster Vulnerability Compromises User-readable Files Tom Daniels (May 10)
- Gnapster Vulnerability Compromises User-readable Files Jim Early (May 10)
- Possible symlink problems with Netscape 4.73 foo (May 10)
- SSH Authentication Vulnerability John P. McNeely (May 10)
- Re: [cert] SSH Authentication Vulnerability Ignacio Kadel-Garcia (May 11)
- Black Watch Labs Vulnerability Alert Black Watch Labs (May 10)
- issues with free Perl CGI's (Re: Black Watch Labs...) Peter W (May 10)
- Advisory: Unchecked system(blaat $var blaat) call in Bugzilla 2.8 Frank van Vliet (May 10)
- Re: Advisory: Unchecked system(blaat $var blaat) call in Bugzilla 2.8 Todd C. Miller (May 10)
- NetStructure 7110 console backdoor Brian Oblivion (May 09)
- NetStructure 7180 remote backdoor vulnerability Brian Oblivion (May 09)
- FreeBSD Security Advisory: FreeBSD-SA-00:16.golddig FreeBSD Security Officer (May 09)
(Thread continues...)