LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: December 12th, 2014
Linux Security Week: December 9th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
KNapster Vulnerability Print E-mail
User Rating:      How can I rate this item?
Posted by LinuxSecurity.com Team   
RedHat Linux It is possible for anyone to obtain any user-readable file by sending a properly formed "GET" command that contains the full path of the file. This vulnerability exists because knapster fails to check that the requested file is an explicitly shared MP3 file before providing it.
KNapster Vulnerability Compromises User-readable Files

This vulnerability was discovered at the Center for Education and Research
in Information Assurance and Security (CERIAS) at Purdue University
 by:

     Tom Daniels 
     Florian Buchholz 
     James Early 

Environment: Intel PII-based System
             Linux Red Hat Version 6.2 (may apply to all OS's running knapster)
             KNapster Version 0.9 (and probably earlier)

Knapster is an open source, independent implementation of the Napster protocol client. 
It is written to conform to the KDE windowing environment.

Problem: It is possible for anyone to obtain any user-readable file by sending a
         properly formed "GET" command that contains the full path of
         the file. This vulnerability exists because knapster
         fails to check that the requested file is an explicitly shared MP3 file
         before providing it.

Note: This is the same vulnerability described in FreeBSD-SA-00:18 but in
knapster instead of gnapster.
         Anyone running knapster version 0.9 or less is vulnerable.  Given the
         IP address and TCP port of a vulnerable client, an attacker can
         send a request for an arbitrary file to the knapster client.  If the
         user has read access to the file, the client will then respond with
         the contents of the file.

Solution: We contacted the program's author, and he promptly created
          a new version which addresses this vulnerability. The fix simply
          checks that a requested file is in the list of shared files. The current
          version can be downloaded from:

          http://knapster.netpedia.net/#DOWNLOAD

Exploit: Two of us have developed an exploit code for this vulnerability, but we will
         not be releasing this to the public.

Conclusion: We have described a vulnerability in one client implementation of the napster 
protocol. There may be similar problems in other implementations 
of the protocol  as we have not done an exhaustive search.  
The official Windows client does not seem to be affected
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
University of California, Berkeley Hacked, Data Compromised
London teen pleads guilty to Spamhaus DDoS
New England security group shares threat intelligence, strives to bolster region
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.