“Secunia Advisory: SA14555

Critical: Moderately critical

Impact: Exposure of sensitive information

Where: From remote

Solution Status: Vendor Patch

Software: LimeWire 4.x

Kevin Walsh has reported two vulnerabilities in LimeWire, which can be exploited by malicious people to disclose sensitive information.

1) An input validation error in the HTTP handling can be exploited to disclose the content of arbitrary files via a specially crafted request.

Example:
/gnutella/res/[file_with_absolute_path]

The vulnerability has been reported in versions 4.1.2 through 4.5.6.

2) An input validation error in the handling of “magnet” requests can be exploited to disclose the content of arbitrary files via directory traversal attacks.

Example:
/magnet10/../../[file]

The vulnerability has been reported in versions 3.9.6 through 4.6.0.

Solution:
Update to version 4.8 or later.
http://www.limewire.com/english/content/download.shtml“

Full article: Secunia Advisory: SA14555