BID:26618

GNUMP3d Password Protection Security Bypass Vulnerability

Info

GNUMP3d Password Protection Security Bypass Vulnerability

Bugtraq ID:	26618
Class:	Access Validation Error
CVE:	CVE-2007-6130
Remote:	Yes
Local:	No
Published:	Sep 20 2007 12:00AM
Updated:	Dec 06 2007 01:02AM
Credit:	James <[email protected]> discovered this vulnerability.
Vulnerable:	SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 GNU gnump3d 2.9.9 GNU gnump3d 2.9.8 GNU gnump3d 2.9.7 + Gentoo Linux GNU gnump3d 2.9.6 GNU gnump3d 2.9.5 + Gentoo Linux GNU gnump3d 2.9.4 GNU gnump3d 2.9.3 GNU gnump3d 2.9.2 GNU gnump3d 2.9.1 GNU gnump3d 2.9 Gentoo Linux

Not Vulnerable:	GNU gnump3d 3.0

Discussion

GNUMP3d Password Protection Security Bypass Vulnerability

GNUMP3d is prone to a security-bypass vulnerability because it fails to properly validate user credentials before performing certain actions.

A successful attack will allow an unauthorized attacker to download or stream media without being authorized.

This issue affects versions prior to GNUMP3d 3.0.

Exploit / POC

GNUMP3d Password Protection Security Bypass Vulnerability

An attacker can exploit this issue through a browser.

Solution / Fix

GNUMP3d Password Protection Security Bypass Vulnerability

Solution:
The vendor has released updates to address this issue and has removed the broken password-protection functionality from the application. Please see the references for more information.

GNU gnump3d 2.9