Benjamin Juang (ibneko) wrote,
Benjamin Juang
ibneko

aMule vulnerablities (mostly for porsupah since he uses it too...)

TITLE:
aMule Information Disclosure Vulnerability

SECUNIA ADVISORY ID:
SA20351

VERIFY ADVISORY:
http://secunia.com/advisories/20351/

CRITICAL:
Moderately critical

IMPACT:
Exposure of system information, Exposure of sensitive information

WHERE:
From remote

SOFTWARE:
aMule 2.x
http://secunia.com/product/10189/

DESCRIPTION:
A vulnerability has been reported in aMule, which can be exploited by
malicious people and by malicious users to disclose potentially
sensitive information.

Input passed to unspecified parameters in the URL to aMuleWeb is not
properly sanitised before being used. This can be exploited by
unauthenticated users to gain access to any image files, or by
authenticated users to gain access to html and PHP files on the
system.

Successful exploitation requires that the full pathname of the file
is know.

The vulnerability has been reported in versions prior to 2.1.2.

SOLUTION:
Update to version 2.1.2.
http://www.amule.org/wiki/index.php/Main_Page
Tags: secunia, security
Subscribe
  • Post a new comment

    Error

    Anonymous comments are disabled in this journal

    default userpic

    Your reply will be screened

    Your IP address will be recorded 

  • 1 comment