PT-2006-6943 · Torrentflux · Torrentflux

Stefan Fritsch · Published 2006-12-06 · Updated 2008-09-05 · CVE-2006-6331

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TorrentFlux version 2.2

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the torrent parameter to API endpoints such as "details.php" and "startpop.php", when the $cfg["enable file priority"] is set to false.

Recommendations For TorrentFlux version 2.2, consider setting $cfg["enable file priority"] to true as a temporary workaround to mitigate the risk of exploitation. Restrict access to the "details.php" and "startpop.php" API endpoints to minimize the risk of exploitation. Avoid using shell metacharacters in the torrent parameter until the issue is resolved.

Fix

Related Identifiers

CVE-2006-6331

Affected Products

Torrentflux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-6331 · Security Note
• http://secunia.com/advisories/23270 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi/11_missed_security_fixes.dpatch?bug=400582%3Bmsg=71%3Batt=1 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=%23400582 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6331 · Note