It was discovered that the Rasterbar Bittorrent library performed insufficient validation of path names specified in torrent files, which could lead to denial of service by overwriting files.

The remote host is affected by the vulnerability described in GLSA-200907-14 (Rasterbar libtorrent: Directory traversal)

    census reported a directory traversal vulnerability in     src/torrent_info.cpp that can be triggered via .torrent files.
  Impact :

    A remote attacker could entice a user or automated system using     Rasterbar libtorrent to load a specially crafted BitTorrent file to     create or overwrite arbitrary files using dot dot sequences in     filenames.
  Workaround :

    There is no known workaround at this time.

A security vulnerability has been identified and corrected in libtorrent-rasterbar :

Directory traversal vulnerability in src/torrent_info.cpp in Rasterbar libtorrent before 0.14.4, as used in firetorrent, qBittorrent, deluge Torrent, and other applications, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) and partial relative pathname in a Multiple File Mode list element in a .torrent file (CVE-2009-1760).

The updated packages have been patched to prevent this.

libtorrent-rasterbar にセキュリティの脆弱性が見つかり、修正されました：

0.14.4 より前の Rasterbar libtorrent の src/torrent_info.cpp のディレクトリトラバーサルの脆弱性が、firetorrent、qBittorrent、deluge Torrent、および他のアプリケーションで使用されるように、リモートの攻撃者が任意のファイルを.torrent ファイルの複数ファイルモードリスト要素で ..（ドットドット）と部分的な関連パス名により作成または上書きする可能性があります（CVE-2009-1760）。

これを回避する更新済みパッケージのパッチが適用されました。

This release adds an upstream patch to fix a directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a '..' (dot dot) and partial relative pathname in a specially crafted torrent.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release adds a backported upstream patch to fix a directory traversal vulnerability in the included copy of libtorrent which would allow a remote attacker to create or overwrite arbitrary files via a '..' (dot dot) and partial relative pathname in a specially crafted torrent.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release adds an upstream patch to fix a directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a '..' (dot dot) and partial relative pathname in a specially crafted torrent. In addition to this, asio-devel has been added to the dependencies for the rb_libtorrent-devel package - a fix already applied to the Fedora 10, 11, and Development ('Rawhide') packages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Deluge 1.1.9 contains updated translations and fixes for a 'move torrent' issue (now only happens when the torrent has data downloaded), a folder renaming bug (renaming a parent folder into multiple folders), and an issue with adding a remote torrent in the WebUI. This update also includes all upstream bug-fixes and enhancements in versions 1.1.7 and 1.1.8 (which were skipped in this package). For a full list of these changes, please see the upstream changelog: http://dev.deluge-torrent.org/wiki/ChangeLog In addition, the included copy of rb_libtorrent has been updated to fix a potential directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a '..' (dot dot) and partial relative pathname in a specially crafted torrent.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
39391	Debian DSA-1815-1 : libtorrent-rasterbar - programming error	Nessus	Debian Local Security Checks	2009/6/16	2021/1/4	medium
39868	GLSA-200907-14 : Rasterbar libtorrent: Directory traversal	Nessus	Gentoo Local Security Checks	2009/7/20	2021/1/6	medium
48148	Mandriva Linux Security Advisory : libtorrent-rasterbar (MDVSA-2009:139)	Nessus	Mandriva Local Security Checks	2010/7/30	2021/1/6	medium
48148	Mandriva Linux セキュリティアドバイザリ：libtorrent-rasterbar（MDVSA-2009:139）	Nessus	Mandriva Local Security Checks	2010/7/30	2021/1/6	medium
39542	Fedora 11 : rb_libtorrent-0.14.3-2.fc11 (2009-6502)	Nessus	Fedora Local Security Checks	2009/6/28	2021/1/11	medium
39545	Fedora 9 : deluge-0.5.9.3-2.fc9 (2009-6682)	Nessus	Fedora Local Security Checks	2009/6/28	2021/1/11	medium
39543	Fedora 10 : rb_libtorrent-0.13.1-5.fc10 (2009-6547)	Nessus	Fedora Local Security Checks	2009/6/28	2021/1/11	medium
39544	Fedora 9 : rb_libtorrent-0.12.1-2.fc9 (2009-6619)	Nessus	Fedora Local Security Checks	2009/6/28	2021/1/11	medium
39546	Fedora 10 : deluge-1.1.9-1.fc10 (2009-6760)	Nessus	Fedora Local Security Checks	2009/6/28	2021/1/11	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium