[Mldonkey-bugs] [Bug #1373] Security: filename with a slash

[nobody]

=================== BUG #1373: FULL BUG SNAPSHOT ===================
http://savannah.nongnu.org/bugs/?func=detailbug&bug_id=1373&group_id=1409

Submitted by: None                      Project: mldonkey, a free e-Donkey 
client
Submitted on: 2002-Oct-08 21:36
Category:  Core                         Severity:  5 - Major                    
Bug Group:  None                        Resolution:  None                       
Assigned to:  None                      Status:  Open                           
Release:  1.16                          Release:                                
Platform Version:  Linux i386-i686      Binaries Origin:  Downloaded from 
Savannah

Summary:  Security: filename with a slash

Original Submission:  When downloading a file called "this is/a file.zip", 
mldonkey will create a directory called "this is" and download a file called "a 
file.zip" inside. I don't think this should be allowed.
I haven't checked, but may be the same happens with a file called 
"../../../etc/passwd". Anyone?

I guess mldonkey should remove all /'s from the local file name.

Regards,
Ernesto
xtango"at"netcombbs.com.ar




No Followups Have Been Posted


CC list is empty


No files currently attached


For detailed info, follow this link:
http://savannah.nongnu.org/bugs/?func=detailbug&bug_id=1373&group_id=1409