PT-2015-6932 · Bittorrent · Utorrent+1

Andrea Micalizzi + 1 · Published 2015-07-20 · Updated 2015-08-13 · CVE-2015-5474

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BitTorrent versions (affected versions not specified) uTorrent versions (affected versions not specified)

Description The issue allows remote attackers to inject command line parameters and execute arbitrary commands via a crafted URL using the (1) bittorrent or (2) magnet protocol.

Recommendations For BitTorrent, consider disabling the handling of bittorrent and magnet protocols until a patch is available. For uTorrent, restrict access to the URI protocol handler to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2015-5474

ZDI-15-358

Affected Products

Qbittorrent

Utorrent

References · 3

• https://zerodayinitiative.com/advisories/ZDI-15-358 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-5474 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-15-358 · Note