PT-2015-6932 · Bittorrent · Utorrent+1

Andrea Micalizzi + 1 · Publicado 2015-07-20 · Atualizado 2015-08-13 · CVE-2015-5474

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BitTorrent versions (affected versions not specified) uTorrent versions (affected versions not specified)

Description The issue allows remote attackers to inject command line parameters and execute arbitrary commands via a crafted URL using the (1) bittorrent or (2) magnet protocol.

Recommendations For BitTorrent, consider disabling the handling of bittorrent and magnet protocols until a patch is available. For uTorrent, restrict access to the URI protocol handler to minimize the risk of exploitation.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2015-5474

ZDI-15-358

Produtos afetados

Qbittorrent

Utorrent

Referências · 3

• https://zerodayinitiative.com/advisories/ZDI-15-358 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-15-358 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5474 · Nota de Segurança