Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file.

A vulnerability has been found and corrected in transmission :

Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file (CVE-2010-0012).

The updated packages have been patched to correct this issue.

Multiple vulnerabilities has been found and corrected in transmission :

Cross-site request forgery (CSRF) vulnerability in Transmission 1.5 before 1.53 and 1.6 before 1.61 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors (CVE-2009-1757).

Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file (CVE-2010-0012).

The updated packages have been patched to correct these issues.

Dan Rosenberg discovered that Transmission, a lightwight client for the Bittorrent filesharing protocol, performs insufficient sanitising of file names specified in .torrent files. This could lead to the overwrite of local files with the privileges of the user running Transmission if the user is tricked into opening a malicious torrent file.

Specially crafted torrent files could overwrite arbitrary files.

It was discovered that the Transmission web interface was vulnerable to cross-site request forgery (CSRF) attacks. If a user were tricked into opening a specially crafted web page in a browser while Transmission was running, an attacker could trigger commands in Transmission. This issue affected Ubuntu 9.04. (CVE-2009-1757)

Dan Rosenberg discovered that Transmission did not properly perform input validation when processing torrent files. If a user were tricked into opening a crafted torrent file, an attacker could overwrite files via directory traversal. (CVE-2010-0012).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
48168	Mandriva Linux Security Advisory : transmission (MDVSA-2010:014)	Nessus	Mandriva Local Security Checks	medium
48167	Mandriva Linux Security Advisory : transmission (MDVSA-2010:013)	Nessus	Mandriva Local Security Checks	medium
44832	Debian DSA-1967-1 : transmission - directory traversal	Nessus	Debian Local Security Checks	medium
44114	openSUSE Security Update : transmission (transmission-1777)	Nessus	SuSE Local Security Checks	medium
44113	openSUSE Security Update : transmission (transmission-1777)	Nessus	SuSE Local Security Checks	medium
44112	openSUSE Security Update : transmission (transmission-1777)	Nessus	SuSE Local Security Checks	medium
44039	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : transmission vulnerabilities (USN-885-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2010-0012

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium