aria2: Directory traversal

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
net-misc/aria2	< 1.9.3	>= 1.9.3	All supported architectures

Related bugreports: #320975

A directory traversal vulnerability has been found in aria2.

2. Impact Information

aria2 is a download utility with resuming and segmented downloading with HTTP/HTTPS/FTP/BitTorrent support.

A directory traversal vulnerability was discovered in aria2.

A remote attacker could entice a user to download from a specially crafted metalink file, resulting in the creation of arbitrary files.

3. Resolution Information

There is no known workaround at this time.

All aria2 users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/aria2-1.9.3"

4. References

Page updated January 15, 2011

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.