[21981] in bugtraq
KaZaA + Morpheus sharing files
daemon@ATHENA.MIT.EDU (Eric Lee)
Sun Jul 29 04:12:18 2001
Date: 29 Jul 2001 07:18:12 -0000
Message-ID: <20010729071812.20422.qmail@securityfocus.com>
From: Eric Lee <eleecomputers@operamail.com>
To: bugtraq@securityfocus.com
Hi everybody, I'm new here and I hope I don't step on anyone's toes. A quick search for kazaa in the box at the top doesn't show anything near this.
I've found a bug in Kazaa 1.3.1 and Morpheus 1.3. I'll refer to them as K/M. I've found this bug to occur when the download directory is changed from the default "My Shared Folder" to something else.
In K/M go to Tools menu and choose Options. Under the Downloads and uploads tab change the folder for downloaded files to something else, for example c:\downloads. Now choose Find media to share... from the Tools menu and click on Folder List. Click Deselect all to make sure you aren't explicitly sharing any files.
Close K/M and remove it from the tray. Now open K/M again.
Connect to http://yourip:1214 in your web browser and you should see some files. If you don't, try changing your downloaded folders location to something like c:\ or c:\windows.
Workarounds include keeping the download directory at the default My Shared Folder, using a firewall to block incoming requests to port 1214 and checking the box that says Disable file sharing with other Kazaa/Morpheus users in the Downloads and uploads tab.
I've been able to get this to work on my Win95 computer and various pals Win98, 95 computers. I haven't been able to reproduce it on a Win2k Pro computer.
I hope I did this right :)
Eric Lee
