[ GLSA 200909-06 ] aMule: Parameter injection

[GLSA]

Gentoo Linux Security Advisory

Title: aMule: Parameter injection (GLSA 200909-06)
Severity: normal
Exploitable: remote
Date: September 09, 2009
Bug(s): #268163
ID: 200909-06

Synopsis


An input validation error in aMule enables remote attackers to pass
arbitrary parameters to a victim's media player.


Background


aMule is an eMule-like client for the eD2k and Kademlia networks,
supporting multiple platforms.


Affected Packages

Package: net-p2p/amule
Vulnerable: < 2.2.5
Unaffected: >= 2.2.5
Architectures: All supported architectures


Description


Sam Hocevar discovered that the aMule preview function does not
properly sanitize file names.


Impact


A remote attacker could entice a user to download a file with a
specially crafted file name to inject arbitrary arguments to the
victim's video player.


Workaround


There is no known workaround at this time.


Resolution


All aMule users should upgrade to the latest version: