Stay Secure with the Latest Linux Advisories

security advisoryunauthorized accessRed Hat

Red Hat: RHSA-2000:022-01 Moderate: Knapster Unauthorized File Access

It is possible for anyone to obtain any user-readable file by sending a properly formed "GET" command that contains the full path of the file. This vulnerability exists because knapster fails to check that the requested file is an explicitly shared MP3 file before providing it. . KNapster Vulnerability Compromises User-readable Files This vulnerability was discovered at the Center for Education and Research in Information Assurance and Security (CERIAS) at Purdue University by: Tom Daniels Florian Buchholz James Early Environment: Intel PII-based System Linux Red Hat Version 6.2 (may apply to all OS's running knapster) KNapster Version 0.9 (and probably earlier) Knapster is an open source, independent implementation of the Napster protocol client. It is written to conform to the KDE windowing environment. Problem: It is possible for anyone to obtain any user-readable file by sending a properly formed "GET" command that contains the full path of the file. This vulnerability exists because knapster fails to check that the requested file is an explicitly shared MP3 file before providing it. Note: This is the same vulnerability described in FreeBSD-SA-00:18 but in knapster instead of gnapster. Anyone running knapster version 0.9 or less is vulnerable. Given the IP address and TCP port of a vulnerable client, an attacker can send a request for an arbitrary file to the knapster client. If the user has read access to the file, the client will then respond with the contents of the file. Solution: We contacted the program's author, and he promptly created a new version which addresses this vulnerability. The fix simply checks that a requested file is in the list of shared files. The current version can be downloaded from: http://vtun.netpedia.net/ Exploit: Two of us have developed an exploit codefor this vulnerability, but we will not be releasing this to the public. Conclusion: We have described a vulnerability in one client implementation of the napster protocol. There may be similar problems in other implementations of the protocol as we have not done an exhaustive search. The official Windows client does not seem to be affected . The DataShift vulnerability allows sensitive information to be accessed by malicious actors via a crafted POST request. Investigate possible remedies contained within.. Knapster Security, Red Hat Vulnerability, File Access Issues, Remote Exploit. . Severity: Important. LinuxSecurity.com Team

May 11, 2000 •Important Red Hat