?

Log in

No account? Create an account
entries friends calendar profile Previous Previous Next Next
aMule vulnerablities (mostly for porsupah since he uses it too...) - IBNeko's Journal-Nyo~!
ibneko
ibneko
aMule vulnerablities (mostly for porsupah since he uses it too...)
TITLE:
aMule Information Disclosure Vulnerability

SECUNIA ADVISORY ID:
SA20351

VERIFY ADVISORY:
http://secunia.com/advisories/20351/

CRITICAL:
Moderately critical

IMPACT:
Exposure of system information, Exposure of sensitive information

WHERE:
From remote

SOFTWARE:
aMule 2.x
http://secunia.com/product/10189/

DESCRIPTION:
A vulnerability has been reported in aMule, which can be exploited by
malicious people and by malicious users to disclose potentially
sensitive information.

Input passed to unspecified parameters in the URL to aMuleWeb is not
properly sanitised before being used. This can be exploited by
unauthenticated users to gain access to any image files, or by
authenticated users to gain access to html and PHP files on the
system.

Successful exploitation requires that the full pathname of the file
is know.

The vulnerability has been reported in versions prior to 2.1.2.

SOLUTION:
Update to version 2.1.2.
http://www.amule.org/wiki/index.php/Main_Page

Tags: ,

1 happy kitten | Leave catnip
Comments
porsupah From: porsupah Date: May 29th, 2006 03:08 pm (UTC) (Link)
Ah, handy. Not a huge bug, but not one to leave lying around, and I've got 2.0.1 sitting here.. :-P

1 happy kitten | Leave catnip