Directory traversal vulnerability in src/torrent_info.cpp in Rasterbar libtorrent before 0.14.4, as used in firetorrent, qBittorrent, deluge Torrent, and other applications, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) and partial relative pathname in a Multiple File Mode list element in a .torrent file.

A security vulnerability has been identified and corrected in libtorrent-rasterbar :

Directory traversal vulnerability in src/torrent_info.cpp in Rasterbar libtorrent before 0.14.4, as used in firetorrent, qBittorrent, deluge Torrent, and other applications, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) and partial relative pathname in a Multiple File Mode list element in a .torrent file (CVE-2009-1760).

The updated packages have been patched to prevent this.

The remote host is affected by the vulnerability described in GLSA-200907-14 (Rasterbar libtorrent: Directory traversal)

    census reported a directory traversal vulnerability in     src/torrent_info.cpp that can be triggered via .torrent files.
  Impact :

    A remote attacker could entice a user or automated system using     Rasterbar libtorrent to load a specially crafted BitTorrent file to     create or overwrite arbitrary files using dot dot sequences in     filenames.
  Workaround :

    There is no known workaround at this time.

Deluge 1.1.9 contains updated translations and fixes for a 'move torrent' issue (now only happens when the torrent has data downloaded), a folder renaming bug (renaming a parent folder into multiple folders), and an issue with adding a remote torrent in the WebUI. This update also includes all upstream bug-fixes and enhancements in versions 1.1.7 and 1.1.8 (which were skipped in this package). For a full list of these changes, please see the upstream changelog: http://dev.deluge-torrent.org/wiki/ChangeLog In addition, the included copy of rb_libtorrent has been updated to fix a potential directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a '..' (dot dot) and partial relative pathname in a specially crafted torrent.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release adds a backported upstream patch to fix a directory traversal vulnerability in the included copy of libtorrent which would allow a remote attacker to create or overwrite arbitrary files via a '..' (dot dot) and partial relative pathname in a specially crafted torrent.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release adds an upstream patch to fix a directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a '..' (dot dot) and partial relative pathname in a specially crafted torrent. In addition to this, asio-devel has been added to the dependencies for the rb_libtorrent-devel package - a fix already applied to the Fedora 10, 11, and Development ('Rawhide') packages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release adds an upstream patch to fix a directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a '..' (dot dot) and partial relative pathname in a specially crafted torrent.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Rasterbar Bittorrent library performed insufficient validation of path names specified in torrent files, which could lead to denial of service by overwriting files.

ID	Name	Product	Family	Severity
48148	Mandriva Linux Security Advisory : libtorrent-rasterbar (MDVSA-2009:139)	Nessus	Mandriva Local Security Checks	medium
39868	GLSA-200907-14 : Rasterbar libtorrent: Directory traversal	Nessus	Gentoo Local Security Checks	medium
39546	Fedora 10 : deluge-1.1.9-1.fc10 (2009-6760)	Nessus	Fedora Local Security Checks	medium
39545	Fedora 9 : deluge-0.5.9.3-2.fc9 (2009-6682)	Nessus	Fedora Local Security Checks	medium
39544	Fedora 9 : rb_libtorrent-0.12.1-2.fc9 (2009-6619)	Nessus	Fedora Local Security Checks	medium
39543	Fedora 10 : rb_libtorrent-0.13.1-5.fc10 (2009-6547)	Nessus	Fedora Local Security Checks	medium
39542	Fedora 11 : rb_libtorrent-0.14.3-2.fc11 (2009-6502)	Nessus	Fedora Local Security Checks	medium
39391	Debian DSA-1815-1 : libtorrent-rasterbar - programming error	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2009-1760

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium