oss-security - CVE request: mldonkey arbitrary file download vulnerability

Message-ID: <87wsbgommq.fsf@mid.deneb.enyo.de>
Date: Mon, 23 Feb 2009 22:43:09 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: CVE request: mldonkey arbitrary file download vulnerability

mldonkey in version 2.9.7 and earlier permits remote attackers to
download arbitrary files accessible to the mldonkey daemon, using
crafted requests to the HTTP console.

<https://savannah.nongnu.org/bugs/?25667>

(The proposed patch deals with this in a rather odd place.)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.