aMule Forum

Please login or register.

Login with username, password and session length
Advanced search  

News:

We're back! (IN POG FORM)

Author Topic: CVE-2009-1440 really fixed in 2.2.5?  (Read 3888 times)

Festor

  • Hero Member
  • *****
  • Karma: 79
  • Offline Offline
  • Posts: 935
  • Offline -> Studying...
CVE-2009-1440 really fixed in 2.2.5?
« on: July 26, 2009, 01:41:18 AM »

Searching in Debian bug tracker I found this:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=525078#27

Stu Redman

  • Administrator
  • Hero Member
  • *****
  • Karma: 214
  • Offline Offline
  • Posts: 3739
  • Engines screaming
Re: CVE-2009-1440 really fixed in 2.2.5?
« Reply #1 on: July 26, 2009, 02:30:00 PM »

Hmm - tried it and could reproduce the problem:
Quote
   Quick (and harmless) way to simulate an attack and reproduce the bug:

    - run amule from the command line
    - set video player to "vlc" in the preferences
    - start downloading a file (use the search tool to find a small
      txt file)
    - pause download using right click -> Pause
    - rename file to '-vvvv.avi (with a leading tick) using right
      click -> Show File Details
    - resume download, wait for completion
    - double click on the file
    - you should see VLC's very verbose debug messages in amule's console,
      indicating that it has been called with -vvvv.avi as an extra
      argument, increasing its verbosity
:(

Didn't try the suggested fix
Quote
   The following fix works, though (tested with 2.2.5):

     rawFileName.Replace(QUOTE, wxT("\\") QUOTE);
Logged
The image of mother goddess, lying dormant in the eyes of the dead, the sheaf of the corn is broken, end the harvest, throw the dead on the pyre -- Iron Maiden, Isle of Avalon

Festor

  • Hero Member
  • *****
  • Karma: 79
  • Offline Offline
  • Posts: 935
  • Offline -> Studying...
Re: CVE-2009-1440 really fixed in 2.2.5?
« Reply #2 on: July 27, 2009, 12:26:58 PM »

Then there's a problem, right?

Should I patch my aMule builds or there will be a 2.2.6? (or a "2.2.5.1" release)  ::)
« Last Edit: July 27, 2009, 12:29:17 PM by Festor »
Logged

GonoszTopi

  • The current man in charge of most things.
  • Administrator
  • Hero Member
  • *****
  • Karma: 169
  • Offline Offline
  • Posts: 2685
Re: CVE-2009-1440 really fixed in 2.2.5?
« Reply #3 on: July 27, 2009, 07:43:34 PM »

Didn't try the suggested fix
Could you please?

or there will be a 2.2.6?
Don't know yet. Last release was almost 3 months ago, and this is the second patch affecting 2.2.5 I consider serious.
Logged
concordia cum veritate

Stu Redman

  • Administrator
  • Hero Member
  • *****
  • Karma: 214
  • Offline Offline
  • Posts: 3739
  • Engines screaming
Re: CVE-2009-1440 really fixed in 2.2.5?
« Reply #4 on: July 28, 2009, 12:22:50 AM »

Then there's a problem, right?
Yeah, just as serious as this one::)

Didn't try the suggested fix
Could you please?
Fix works. No super-verbose messages, and file is actually played back (I downloaded an mp3). I've tried '-vvvv.avi and Bla'-vvvv Bla.avi Don't know if there are other constellations thinkable.
Logged
The image of mother goddess, lying dormant in the eyes of the dead, the sheaf of the corn is broken, end the harvest, throw the dead on the pyre -- Iron Maiden, Isle of Avalon

wires

  • Jr. Member
  • **
  • Karma: 6
  • Offline Offline
  • Posts: 83
Re: CVE-2009-1440 really fixed in 2.2.5?
« Reply #5 on: July 28, 2009, 07:19:17 AM »


Fix works. No super-verbose messages, and file is actually played back (I downloaded an mp3). I've tried '-vvvv.avi and Bla'-vvvv Bla.avi Don't know if there are other constellations thinkable.

What about using "file:///<TEMPDIR>/<PARTFILE>" as the file argument and/or using "vlc -- <PARTFILE>". At least for linux '--' denotes end of options.
Logged

Kry

  • Ex-developer
  • Retired admin
  • Hero Member
  • *****
  • Karma: -665
  • Offline Offline
  • Posts: 5795
Re: CVE-2009-1440 really fixed in 2.2.5?
« Reply #6 on: July 28, 2009, 08:53:23 AM »

Don't know yet. Last release was almost 3 months ago, and this is the second patch affecting 2.2.5 I consider serious.

Do.
Logged