Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.

The remote host is affected by the vulnerability described in GLSA-201101-04 (aria2: Directory traversal)

    A directory traversal vulnerability was discovered in aria2.
  Impact :

    A remote attacker could entice a user to download from a specially     crafted metalink file, resulting in the creation of arbitrary files.
  Workaround :

    There is no known workaround at this time.

Specially crafted metalink files could trick aria2 into store downloaded files outside of the intended directory (CVE-2010-1512).

- Thu May 20 2010 Rahul Sundaram <sundaram at     fedoraproject.org> - 1.9.3-1

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=2101

    - Fixes CVE-2010-1512. rhbz # 592014

    - Sat Mar 20 2010 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.9.0-1

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1990

    - Tue Feb 16 2010 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.8.2-1

    - Several bug fixes

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1860

    - Mon Dec 28 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.8.0-1

    - Many new features including XML RPC improvements and       other bug fixes

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1778

    - Mon Dec 7 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.7.1-1

    - Option --bt-prioritize-piece=tail will work again

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1721

    - Wed Nov 4 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.6.3-1

    - Minor bug fixes

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1616

    - Sat Oct 10 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.6.2-1

    - Minor bug fixes and switch XZ compressed source

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1586

    - Thu Oct 8 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.6.1-1

    - Fixes memory leak in HTTP/FTP downloads and other       minor bug fixes

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1569

    - Wed Sep 23 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.6.0-1

    - Minor bug fixes

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1544

    - Mon Aug 24 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.5.2-1

    - Minor bug fixes

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1504

    - Sun Jul 26 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.5.1-2

    - update source

    - Sun Jul 26 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.5.1-1

    - Minor bug fixes

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1494

    - Fixed the license tag

    - Sun Jul 26 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.5.0-1

    - Mostly minor bug fixes

    - WEB-Seeding support for multi-file torrent

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1476

    - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.3.1-2

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu May 20 2010 Rahul Sundaram <sundaram at     fedoraproject.org> - 1.9.3-1

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=2101

    - Fixes CVE-2010-1512. rhbz # 592014

    - Sat Mar 20 2010 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.9.0-1

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1990

    - Tue Feb 16 2010 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.8.2-1

    - Several bug fixes

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1860

    - Mon Dec 28 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.8.0-1

    - Many new features including XML RPC improvements and       other bug fixes

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1778

    - Mon Dec 7 2009 Rahul Sundaram <sundaram at       fedoraproject.org> - 1.7.1-1

    - Option --bt-prioritize-piece=tail will work again

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=1721

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu May 20 2010 Rahul Sundaram <sundaram at     fedoraproject.org> - 1.9.3-1

    -       http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NE       WS?revision=2101

    - Fixes CVE-2010-1512. rhbz # 592014

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This aria2 update to 1.9.3 fixes a metalink name Directory Traversal issue (CVE-2010-1512).

The version was also bumped from 1.8.2 to 1.9.3 to fix lots of bugs.

A vulnerability was discovered in aria2 which allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file (CVE-2010-1512).

This update fixes this issue.

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

A vulnerability was discovered in aria2, a download client. The 'name' attribute of the 'file' element of metalink files is not properly sanitised before using it to download files. If a user is tricked into downloading from a specially crafted metalink file, this can be exploited to download files to directories outside of the intended download directory.

ID	Name	Product	Family	Severity
51534	GLSA-201101-04 : aria2: Directory traversal	Nessus	Gentoo Local Security Checks	medium
49212	openSUSE Security Update : aria2 (openSUSE-SU-2010:0338-2)	Nessus	SuSE Local Security Checks	medium
47518	Fedora 11 : aria2-1.9.3-1.fc11 (2010-8915)	Nessus	Fedora Local Security Checks	medium
47516	Fedora 12 : aria2-1.9.3-1.fc12 (2010-8908)	Nessus	Fedora Local Security Checks	medium
47515	Fedora 13 : aria2-1.9.3-1.fc13 (2010-8905)	Nessus	Fedora Local Security Checks	medium
47134	openSUSE Security Update : aria2 (openSUSE-SU-2010:0338-1)	Nessus	SuSE Local Security Checks	medium
46711	Mandriva Linux Security Advisory : aria2 (MDVSA-2010:106)	Nessus	Mandriva Local Security Checks	medium
46352	Debian DSA-2047-1 : aria2 - insufficient input sanitising	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2010-1512

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium