Nathaniel Bray Yeemp File Transfer Public Key Verification Bypass Vulnerability

Bugtraq ID:	11353
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 08 2004 12:00AM
Updated:	Oct 08 2004 12:00AM
Credit:	This issue was reported by the vendor.
Vulnerable:	Nathaniel Bray Yeemp 0.9.9 Nathaniel Bray Yeemp 0.5.1 - Debian Linux 3.0 - Debian Linux 2.3 - Debian Linux 2.2 - FreeBSD FreeBSD 4.5 Nathaniel Bray Yeemp 0.5
Not Vulnerable:	Nathaniel Bray Yeemp 0.9.10

Nathaniel Bray Yeemp File Transfer Public Key Verification Bypass Vulnerability

It is reported that Yeemp does not properly verify public keys when a file is transferred. Yeemp clients are assigned public keys and Yeemp uses public keys to authenticate users and encrypt messages. Reportedly, the application does not verify keys on incoming files. Due to this, remote attackers are able to spoof sender information and send potentially malicious files to users.

Yeemp versions 0.9.9 and earlier are affected by this issue.

Nathaniel Bray Yeemp File Transfer Public Key Verification Bypass Vulnerability

An exploit is not required to leverage this attack.

Nathaniel Bray Yeemp File Transfer Public Key Verification Bypass Vulnerability

Solution:
The vendor has released Yeemp 0.9.10 to address this issue.


Nathaniel Bray Yeemp 0.5

• Nathaniel Bray Yeemp 0.9.10
  http://deekoo.net/technocracy/yeemp/

Nathaniel Bray Yeemp 0.5.1

• Nathaniel Bray Yeemp 0.9.10
  http://deekoo.net/technocracy/yeemp/

Nathaniel Bray Yeemp 0.9.9

• Nathaniel Bray Yeemp 0.9.10
  http://deekoo.net/technocracy/yeemp/

Nathaniel Bray Yeemp File Transfer Public Key Verification Bypass Vulnerability

References:

• Yeemp Home Page (Nathaniel Bray)