Date:         Wed, 10 May 2000 14:50:18 -0500
From: Jim Early <earlyjp@CS.PURDUE.EDU>
Subject:      Gnapster Vulnerability Compromises User-readable Files
To: BUGTRAQ@SECURITYFOCUS.COM

Gnapster Vulnerability Compromises User-readable Files

This vulnerability was discovered at the Center for Education and Research
in Information Assurance and Security (CERIAS) at Purdue University
<http://www.cerias.purdue.edu> by:

     Tom Daniels <daniels@cerias.purdue.edu>
     Florian Buchholz <florian@cerias.purdue.edu>
     James Early <earlyjp@cs.purdue.edu>

Environment: Intel PII-based System
             Linux RedHat Version 6.2
               (may apply to all OS's running Gnapster)
             Gnapster Version 1.3.8 (and earlier)
               Gnapster is an open source, independent implementation of
               the Napster protocol client.

Problem: It is possible for anyone to obtain any user-readable file by
         sending a properly formed "GET" command that contains the full
         path of the file. This vulnerability exists because Gnapster
         fails to check that the requested file is an explicitly shared
         MP3 file before providing it.

         Note: This is the same vulnerability described in
               FreeBSD-SA-00:18

         Anyone running Gnapster version 1.3.8 or earlier is vulnerable.
         Given the IP address and TCP port of a vulnerable client, an
         attacker can send a request for an arbitrary file to the
         Gnapster client.  If the user has read access to the file,
         the client will then respond with the contents of the file.

Solution: We contacted the program's author, and he promptly created
          a new version which addresses this vulnerability. The fix simply
          checks that a requested file is in the list of shared files.
          The current version can be downloaded from:

       http://download.sourceforge.net/gnapster/gnapster-1.3.9.tar.gz
								
Exploit: We have developed an exploit code for this vulnerability, but we
         will not be releasing it to the public.

Conclusion: We have described a vulnerability in one client implementation of
            the Napster protocol. There may be similar problems in other
            implementations of the protocol as we have not done an
            exhaustive search.  The official Windows client does not seem to
            be affected. We urge users to upgrade to the latest version of
            Gnapster.