Soulseek, serious exploit found
 

This was also posted in the Peer to Peer News but I thought it was worth a second mention.



Soulseek, created by former Napster programmer Nir Arbe, is a lessor known file-sharing network/application. Although files of any type can be shared, its specialty lies in the diverse independent music to be found within - for electronic music lovers Soulseek an absolute goldmine. But it’s not all good news.

In July 2008, security researcher Laurent Gaffié found a bug in two of the latest versions of the official software - Soulseek 157 NS & 156. The problem was so serious he informed the Soulseek developer on 3rd September 2008. Unfortunately, Laurent heard nothing back so on 14 October 2008 he contacted the developer again. He appears to have been ignored. On 16 May 2009 Laurent tried again to contact the Soulseek team - yet again he had no response so decided to reveal his findings.

More...

http://torrentfreak.com/soulseek-p2p...keover-090530/

http://www.p2p-zone.com/underground/...ad.php?t=24826

although it's not clear this makes a non-irc user vulnerable (most ss users hang in irc-style ss chat rooms) it still looks severe. in the meantime soulseek chief (and ex-napster developer) nir - who says he doesn't recall hearing from laurent about this exploit before - has nevertheless taken his advice and placed a character limit on the search string at the server side. this should make the network safe again without having to propagate a patch thru all the clients. nir says he'll continue to monitor.

- js.

I'm sure all will be well with Soulseek. It's quite a survivor in the day of Bittorrent and Usenet.

don't know where i've been, but i just saw this for the first time...

i love Soulseek...when all else fails:hflag: