Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.3 only checks for the ".." string, which allows remote attackers to overwrite arbitrary files via modified ".." sequences in a torrent filename, as demonstrated by "../" sequences, due to an incomplete fix for CVE-2007-1384.

A directory traversal vulnerability was found in KTorrent prior to 2.1.2, due to an incomplete fix for a prior directory traversal vulnerability that was corrected in version 2.1.2. Previously, KTorrent would only check for the string .., which could permit strings such as ../.

Updated packages have been patched to correct this issue.

Ktorrent insufficiently validated the target file name. A malicious Server could therefore overwrite arbitary files of the user (CVE-2007-1384 / CVE-2007-1799). Another bug could be exploited to crash Ktorrent. (CVE-2007-1385)

USN-436-1 fixed a vulnerability in KTorrent. The original fix for path traversal was incomplete, allowing for alternate vectors of attack.
This update solves the problem.

Bryan Burns of Juniper Networks discovered that KTorrent did not correctly validate the destination file paths nor the HAVE statements sent by torrent peers. A malicious remote peer could send specially crafted messages to overwrite files or execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bryan Burns of Juniper Networks discovered that KTorrent did not correctly validate the destination file paths nor the HAVE statements sent by torrent peers. A malicious remote peer could send specially crafted messages to overwrite files or execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ktorrent insufficiently validated the target file name. A malicious Server could therefore overwrite arbitary files of the user (CVE-2007-1384,CVE-2007-1799). Another bug could be exploited to crash Ktorrent (CVE-2007-1385).

It was discovered that ktorrent, a BitTorrent client for KDE, was vulnerable to a directory traversal bug which potentially allowed remote users to overwrite arbitrary files.

The remote host is affected by the vulnerability described in GLSA-200705-01 (Ktorrent: Multiple vulnerabilities)

    Bryan Burns of Juniper Networks discovered a vulnerability in     chunkcounter.cpp when processing large or negative idx values, and a     directory traversal vulnerability in torrent.cpp.
  Impact :

    A remote attacker could entice a user to download a specially crafted     torrent file, possibly resulting in the remote execution of arbitrary     code with the privileges of the user running Ktorrent.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
37741	Mandrake Linux Security Advisory : ktorrent (MDKSA-2007:095)	Nessus	Mandriva Local Security Checks	medium
29498	SuSE 10 Security Update : ktorrent (ZYPP Patch Number 3049)	Nessus	SuSE Local Security Checks	high
28032	Ubuntu 6.06 LTS / 6.10 / 7.04 : ktorrent vulnerability (USN-436-2)	Nessus	Ubuntu Local Security Checks	medium
28031	Ubuntu 6.06 LTS / 6.10 : ktorrent vulnerabilities (USN-436-1)	Nessus	Ubuntu Local Security Checks	high
27314	openSUSE 10 Security Update : ktorrent (ktorrent-3057)	Nessus	SuSE Local Security Checks	high
26034	Debian DSA-1373-2 : ktorrent - directory traversal	Nessus	Debian Local Security Checks	medium
25131	GLSA-200705-01 : Ktorrent: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2007-1799

high

Tenable Plugins

medium

high

medium

high

high

medium

high