PT-2008-5672 · Bittorrent · Qbittorrent+1

Rhys Kidd · Publicado 2008-10-03 · Atualizado 2017-08-08 · CVE-2008-4434

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: uTorrent versions 1.7.7 build 8179 and earlier BitTorrent versions 6.0.3 build 8642 and earlier

Description: A stack-based buffer overflow issue exists due to a boundary error in the processing of .torrent files. This can be exploited by tricking a user into opening a .torrent file containing an overly long created by field, potentially allowing execution of arbitrary code and causing a denial of service (crash).

Recommendations: For uTorrent versions 1.7.7 build 8179 and earlier, consider avoiding the use of .torrent files with long created by fields until a patch is available. For BitTorrent versions 6.0.3 build 8642 and earlier, restrict the processing of .torrent files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-4434

Produtos afetados

Qbittorrent

Utorrent

Referências · 12

• 🔥 https://exploit-db.com/exploits/6787 · Exploit
• http://secunia.com/advisories/31445 · Aviso do Fabricante
• http://seclists.org/dailydave/2008/q3/0155.html · Nota
• http://secunia.com/advisories/31441 · Aviso do Fabricante
• http://forum.utorrent.com/viewtopic.php?id=44003 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44404 · Nota
• http://securitytracker.com/id?1020664 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4434 · Nota de Segurança
• http://securityfocus.com/bid/30653 · Nota
• http://lists.immunitysec.com/pipermail/dailydave/attachments/20080811/35d6194b/attachment-0001.pdf · Nota
• http://vupen.com/english/advisories/2008/2341 · Nota
• http://vupen.com/english/advisories/2008/2340 · Nota