OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: KNapster Vulnerability Compromises User-readable Files
From: Tom Daniels (danielsCERIAS.PURDUE.EDU)
Date: Wed May 10 2000 - 14:24:10 CDT


KNapster Vulnerability Compromises User-readable Files

This vulnerability was discovered at the Center for Education and Research
in Information Assurance and Security (CERIAS) at Purdue University
<http://www.cerias.purdue.edu> by:

     Tom Daniels <danielscerias.purdue.edu>
     Florian Buchholz <floriancerias.purdue.edu>
     James Early <earlyjpcs.purdue.edu>

Environment: Intel PII-based System
             Linux RedHat Version 6.2 (may apply to all OS's running knapster)
             KNapster Version 0.9 (and probably earlier)

Knapster is an open source, independent implementation of the Napster protocol client. It
is written to conform to the KDE windowing environment.

Problem: It is possible for anyone to obtain any user-readable file by sending a
         properly formed "GET" command that contains the full path of
         the file. This vulnerability exists because knapster
         fails to check that the requested file is an explicitly shared MP3 file
         before providing it.
Note: This is the same vulnerability described in FreeBSD-SA-00:18 but in
knapster instead of gnapster.
         Anyone running knapster version 0.9 or less is vulnerable. Given the
         IP address and TCP port of a vulnerable client, an attacker can
         send a request for an arbitrary file to the knapster client. If the
         user has read access to the file, the client will then respond with
         the contents of the file.

Solution: We contacted the program's author, and he promptly created
          a new version which addresses this vulnerability. The fix simply
          checks that a requested file is in the list of shared files. The current
          version can be downloaded from:
                                                                
          http://knapster.netpedia.net/#DOWNLOAD

Exploit: Two of us have developed an exploit code for this vulnerability, but we will
         not be releasing this to the public.

Conclusion: We have described a vulnerability in one client implementation of
        the napster protocol. There may be similar problems in other implementations
        of the protocol as we have not done an exhaustive search. The official
        Windows client does not seem to be affected. We urge users to upgrade
        to the latest version of knapster.