Rasterbar libtorrent: Directory traversal

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200907-14 / rb_libtorrent deluge
Release Date	July 17, 2009
Latest Revision	July 17, 2009: 01
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
net-libs/rb_libtorrent	< 0.13-r1	>= 0.13-r1	All supported architectures
net-p2p/deluge	< 1.1.9	>= 1.1.9	All supported architectures

Related bugreports: #273156, #273961

Synopsis

A directory traversal vulnerability in Rasterbar libtorrent might allow a remote attacker to overwrite arbitrary files.

2. Impact Information

Background

Rasterbar libtorrent is a C++ BitTorrent implementation focusing on efficiency and scalability. Deluge is a BitTorrent client that ships a copy of libtorrent.

Description

census reported a directory traversal vulnerability in src/torrent_info.cpp that can be triggered via .torrent files.

Impact

A remote attacker could entice a user or automated system using Rasterbar libtorrent to load a specially crafted BitTorrent file to create or overwrite arbitrary files using dot dot sequences in filenames.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Rasterbar libtorrent users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/rb_libtorrent-0.13-r1"

All Deluge users should upgrade to the latest version:

Code Listing 3.2: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-p2p/deluge-1.1.9"

4. References

CVE-2009-1760

Updated July 17, 2009

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.