PT-2008-5672 · Bittorrent · Qbittorrent+1

Rhys Kidd · Published 2008-10-03 · Updated 2017-08-08 · CVE-2008-4434

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: uTorrent versions 1.7.7 build 8179 and earlier BitTorrent versions 6.0.3 build 8642 and earlier

Description: A stack-based buffer overflow issue exists due to a boundary error in the processing of .torrent files. This can be exploited by tricking a user into opening a .torrent file containing an overly long created by field, potentially allowing execution of arbitrary code and causing a denial of service (crash).

Recommendations: For uTorrent versions 1.7.7 build 8179 and earlier, consider avoiding the use of .torrent files with long created by fields until a patch is available. For BitTorrent versions 6.0.3 build 8642 and earlier, restrict the processing of .torrent files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-4434

Affected Products

Qbittorrent

Utorrent

References · 12

• 🔥 https://exploit-db.com/exploits/6787 · Exploit
• http://secunia.com/advisories/31445 · Vendor Advisory
• http://secunia.com/advisories/31441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4434 · Security Note
• http://seclists.org/dailydave/2008/q3/0155.html · Note
• http://forum.utorrent.com/viewtopic.php?id=44003 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44404 · Note
• http://securitytracker.com/id?1020664 · Note
• http://securityfocus.com/bid/30653 · Note
• http://lists.immunitysec.com/pipermail/dailydave/attachments/20080811/35d6194b/attachment-0001.pdf · Note
• http://vupen.com/english/advisories/2008/2341 · Note
• http://vupen.com/english/advisories/2008/2340 · Note