Some time ago, a security issue was reported with this module here:

http://seclists.org/fulldisclosure/2010/Feb/1

A colleague of mine was unable to reproduce the issue, but it would be nice if the maintainer could verify if there is a vulnerability or not before full release, and provide a patch if so.

Comments

univate’s picture

univate commented

I reviewed that link and if this is a problem, which does look like it is, it would only be an issue if have untrusted user uploading or administering mp3 content.

jboeger’s picture

jboeger commented

I have this module running at TimObrien.net

Some IP address is hitting /sites/all/modules/mp3player/mp3player/player.swf

Up to 943,992 hits / 10.22GB

I just blocked the offending IP address from htaccess
file (I'm at cloud sites) but hoping for better solution.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Priority: Normal » Critical
markie’s picture

markie commented
Assigned: Unassigned » markie
Status: Active » Patch (to be ported)

patch available at https://drupal.org/node/2050425 pulls the mp3player out of the module and places it in the libraries area. This allows users to download a secure version of the swf (which has been updated multiple times).

markie’s picture

markie commented
Status: Patch (to be ported) » Needs review

new branch created with fix.. 6.x-2.x

markie’s picture

markie commented
Version: 6.x-1.0-beta1 » 7.x-2.x-dev
Issue summary: View changes
Status: Needs review » Closed (fixed)

moved to 7.x-2.x for further development. 7.x-1.x no longer supported.