MLdonkey <= 2.9.7 HTTP DOUBLE SLASH Arbitrary File Disclosure Vuln

[big one]

http://www.milw0rm.com/exploits/8097

MLdonkey (up to 2.9.7) has a vulnerability that allows remote user to access any
file with rights of running Mldonkey daemon by supplying a
special-crafted request (ok, there's not much special about double
slash) to an Mldonkey http GUI (tcp/4080 usually).

Reference:
https://savannah.nongnu.org/bugs/?25667

Thus, the exploit would be as simple as accessing any file on a remote
host with your browser and double slash:

http://mlhost:4080//etc/passwd

# milw0rm.com [2009-02-23]

[Jamie Strandboge (jdstrand)]

Thank you for using Ubuntu and taking the time to report a bug. This package is in universe and is community supported. If you are able, perhaps you could prepare debdiffs to fix this by following https://wiki.ubuntu.com/SecurityUpdateProcedures.

Possible upstream patch is https://savannah.nongnu.org/patch/download.php?file_id=17518 (but see upstream bug for more information).

[Launchpad Janitor (janitor)]

This bug was fixed in the package mldonkey - 2.9.5-2ubuntu1

---------------
mldonkey (2.9.5-2ubuntu1) jaunty; urgency=low

  * fetch debian/patches/url.dpatch from debian's git.
    Fixes HTTP DOUBLE SLASH Arbitrary File Disclosure Vuln
    LP: #340166

 -- Reinhard Tartler <email address hidden> Thu, 19 Mar 2009 10:42:42 +0100

[Reinhard Tartler (siretart)]

the patch should really be included in hardy-security and intrepid-security as well...

[Jens Braeuer (jens-braeuer)]

I agree with Reinhard, this patch should _really_ be included in hardy as it will be used for a long time. And please put it in intrepid too!

Thanks a lot!

[Jamie Strandboge (jdstrand)]

Thank you for using Ubuntu and taking the time to report a bug. This package is in universe and is community supported. If you are able, perhaps you could prepare debdiffs to fix this by following https://wiki.ubuntu.com/SecurityUpdateProcedures.

[Jens Braeuer (jens-braeuer)]

Please find the attached debdiff for hardy.

I verified the version 2.9.2-1 in hardy is vulnerable and also verified the patch fixed the described problem. Double-Slash now results in Status 404.

Regards,
Jens

[Marc Deslauriers (mdeslaur)]

Thanks for the debdiff Jens. Packages are being built.
I changed the version number in your debdiff as per security update conventions here: https://wiki.ubuntu.com/SecurityUpdateProcedures

Intrepid still needs a debdiff, do you think you could make one?

Thanks.

[Launchpad Janitor (janitor)]

This bug was fixed in the package mldonkey - 2.9.2-2ubuntu0.1

---------------
mldonkey (2.9.2-2ubuntu0.1) hardy-security; urgency=low

  * SECURITY UPDATE: fetch debian/patches/url.dpatch from debian's git.
    Fixes HTTP DOUBLE SLASH Arbitrary File Disclosure Vuln
    LP: #340166
    CVE-2009-0753

 -- Jens Braeuer <email address hidden> Mon, 23 Mar 2009 16:38:41 +0000

[Jens Braeuer (jens-braeuer)]

Marc, here comes the debdiff for intrepid.

Regards, Jens

[Marc Deslauriers (mdeslaur)]

Thanks for the debdiff Jens, packages are building now.

[Launchpad Janitor (janitor)]

This bug was fixed in the package mldonkey - 2.9.5-1ubuntu0.1

---------------
mldonkey (2.9.5-1ubuntu0.1) intrepid-security; urgency=low

  * SECURITY UPDATE: fetch debian/patches/url.dpatch from debian's git.
    Fixes HTTP DOUBLE SLASH Arbitrary File Disclosure Vuln
    LP: #340166
    CVE-2009-0753

 -- Jens Braeuer <email address hidden> Tue, 24 Mar 2009 08:27:22 +0100