lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <3D416F42.59947159@securityglobal.net>
From: smoore.fd at securityglobal.net (Stuart Moore)
Subject: Soulseek gives malicious users access to sensitive 
 files

> I tried a fresh install accepting all defaults, just to see what 
> drives and/or directories get shared by default.

Hi.  The Soulseek vendor responded that Soulseek does not share anything
by default.  But, the vendor mentioned that version 135 and prior
versions contained a bug.  If you chose to share a directory, and then
subsequently choose to 'unshare' one of its subdirectories, the newly
'unshared' subdir may inadvertently become re-shared.  This has
reportedly been corrected in version 136.  We've written an alert on the
topic:

http://securitytracker.com/alerts/2002/Jul/1004819.html

Stuart


==========================================================
Lou Rinaldi wrote:

In much the same way that various search engines are increasingly
stumbling upon passwords, credit card numbers, and other classified
documents, the file sharing application known as Soulseek seems to allow
similarly unrestricted searching. This isn't necessarily a design flaw,
but likely yet another case of potential client-side misconfiguration
opening unintended holes.

Presumably, the solution (as with other programs of this type) would be
for the user to manually limit access only to certain directories (under
Options, File Sharing Configuration). However, putting the onus on the
end user is a bad idea, as we've previously seen with the WinGate
fiasco.

I tried a fresh install accepting all defaults, just to see what drives
and/or directories get shared by default.  Unfortunately, the Soulseek
server is currently down, and the program requires a connection and
account setup before it gets to the directory selection stage. So I have
no way to determine if sensitive information could potentially be shared
as part of a default installation. Regardless, this probably warrants
attention from users of the program, and network administrators alike.

see http://www.soulseek.org/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ