Comments on: Soulseek P2P Application Vulnerable to Remote Takeover

By: Chiquitin

Chiquitin — Mon, 08 Jun 2009 07:28:38 +0000

It’s visible again.

http://forums.slsknet.org/ipb/index.php?showtopic=24110

By: Chiquitin

Chiquitin — Sat, 06 Jun 2009 09:32:21 +0000

Edit:

the topic was made invisible as suggested by Laurent Gaffié.

By: Chiquitin

Chiquitin — Sat, 06 Jun 2009 09:29:30 +0000

It’s fixed. The first patch was on the server side, the remaining issue on the client side is now also patched, so, “updateslsk”, you’re wrong. And “/usr/local/dick”, as explained, the topic was make invisible as suggested by the Laurent Gaffié.

http://forums.slsknet.org/ipb/index.php?showtopic=24181

By: /usr/local/dick

/usr/local/dick — Fri, 05 Jun 2009 18:06:21 +0000

After responding to a worried user last week on the SLSK forum that he should not use the buggy Windows client software any more until a fix was released, I found out the entire topic had been deleted!

The lame developers just do not respond to security reports for almost a year, and only after researcher Laurent Gaffié goes public on FD they suddenly wake up and fix their app.

Way to go guys.

By: updateslsk

updateslsk — Thu, 04 Jun 2009 17:35:24 +0000

A new client as been released patching this issue according to the changelog file : slsknet.org/changelog.html
Also it seems that you can still exploit this security hole by sending directly a search query to another peer using another soulseek version than 157 NS 13e

By: updateslsk

updateslsk — Thu, 04 Jun 2009 17:33:47 +0000

A new client as been released patching this issue according to the changelog file : http://slsknet.org/changelog.html
Also it seems that you can still exploit this security hole by sending directly a search query to another peer using another soulseek version than 157 NS 13e

By: Soulseek inseguro | Remixtures

Soulseek inseguro | Remixtures — Wed, 03 Jun 2009 06:55:59 +0000

[...] o TorrentFreak, a falha foi detectada em Julho de 2008 pelo investigador em segurança informática Laurent [...]

By: Nir Arbel

Nir Arbel — Tue, 02 Jun 2009 23:08:17 +0000

It wasn’t a fake patch, all major avenues of search have been protected from this kind of abuse. The last remaining avenue has to do with some legacy code, is harder to exploit, and likely to affect a much smaller number of users. A client will be released very soon to prevent this last contingency.

By: phil

phil — Tue, 02 Jun 2009 21:01:03 +0000

Fake patch !
Still works !

http://forums.slsknet.org/ipb/index.php?showtopic=24110&st=0&gopid=270684

By: Bedazzler

Bedazzler — Mon, 01 Jun 2009 17:50:12 +0000

let us know if there’s update thx