Bug#516829: Http double slash request arbitrary file access vulnerability

2009-03-16 Thread Mehdi Dogguy
Nico Golde wrote: > Hi, > this bug was marked as pending on February 24th. What is > missing for the upload? Do you need an NMU? > We were fixing other bugs. It will uploaded ASAP (tonight...). Cheers, -- Mehdi Dogguy مهدي الدقي http://www.pps.jussieu.fr/~dogguy Tel.: (+33).1.44.27.28.38

Bug#516829: Http double slash request arbitrary file access vulnerability

2009-03-16 Thread Nico Golde
Hi, this bug was marked as pending on February 24th. What is missing for the upload? Do you need an NMU? Cheers Nico -- Nico Golde - http://www.ngolde.de - n...@jabber.ccc.de - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted. pgpHSyAg1Q2kt.pgp Description

Bug#516829: Http double slash request arbitrary file access vulnerability

2009-03-10 Thread Spiral Voice
Hi, this scan was done against MLDonkey 3.0.0: --- - Nikto 2.02/2.03 - cirt.net + Target IP: 192.168.1.8 + Target Hostname: router + Target Port: 4080 + Start Time: 2009-03-11 22:33:08 -

Bug#516829: Http double slash request arbitrary file access vulnerability

2009-03-10 Thread Spiral Voice
Hi, here is a copy of an email I wrote today: Mehdi Dogguy schrieb: > > Hello, > > > > I'm trying to understand why the submitted patch is enough to fix the > > issue. More particularly, how /../ are removed from the url? > > > > Cheers, > > Hi, the fix for MLDonkey consists of two parts, fi

Bug#516829: Http double slash request arbitrary file access vulnerability

2009-02-24 Thread spiralvoice
Precedence: fm-user Organization: http://freemail.web.de/ X-Provags-Id: V01U2FsdGVkX18MGPaZ0kB3jqxzdFla//RhZdDlbKT4+SAB4XLEDVKbdXOQa 1u9MI7D5wri8mOa6iWhkob6qhR9aWJBTcu4RmAmqYm3XYGi218Q34BV1nnIY A== Content-Type: text/plain; charset=iso-8859-15 Content-Transfer-Encoding: quoted-printable Hi, thi

Bug#516829: Http double slash request arbitrary file access vulnerability

2009-02-23 Thread Giuseppe Iuculano
Package: mldonkey-server Version: 2.9.5-2 Severity: grave Tags: security -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, MLdonkey (up to 2.9.7) has a vulnerability that allows remote user to access any file with rights of running Mldonkey daemon by supplying a special-crafted