Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.2 allows remote attackers to overwrite arbitrary files via ".." sequences in a torrent filename.

Ktorrent insufficiently validated the target file name. A malicious Server could therefore overwrite arbitary files of the user (CVE-2007-1384 / CVE-2007-1799). Another bug could be exploited to crash Ktorrent. (CVE-2007-1385)

Bryan Burns of Juniper Networks discovered that KTorrent did not correctly validate the destination file paths nor the HAVE statements sent by torrent peers. A malicious remote peer could send specially crafted messages to overwrite files or execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ktorrent insufficiently validated the target file name. A malicious Server could therefore overwrite arbitary files of the user (CVE-2007-1384,CVE-2007-1799). Another bug could be exploited to crash Ktorrent (CVE-2007-1385).

The remote host is affected by the vulnerability described in GLSA-200705-01 (Ktorrent: Multiple vulnerabilities)

    Bryan Burns of Juniper Networks discovered a vulnerability in     chunkcounter.cpp when processing large or negative idx values, and a     directory traversal vulnerability in torrent.cpp.
  Impact :

    A remote attacker could entice a user to download a specially crafted     torrent file, possibly resulting in the remote execution of arbitrary     code with the privileges of the user running Ktorrent.
  Workaround :

    There is no known workaround at this time.

New ktorrent packages are available for Slackware 11.0 and -current to fix security issues.

Two problems have been found in KTorrent :

- KTorrent does not properly sanitize file names to filter out '..' components, so it's possible for an attacker to create a malicious torrent in order to overwrite arbitrary files within the filesystem.

- Messages with invalid chunk indexes aren't rejected.

ID	Name	Product	Family	Severity
29498	SuSE 10 Security Update : ktorrent (ZYPP Patch Number 3049)	Nessus	SuSE Local Security Checks	high
28031	Ubuntu 6.06 LTS / 6.10 : ktorrent vulnerabilities (USN-436-1)	Nessus	Ubuntu Local Security Checks	high
27314	openSUSE 10 Security Update : ktorrent (ktorrent-3057)	Nessus	SuSE Local Security Checks	high
25131	GLSA-200705-01 : Ktorrent: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
24917	Slackware 11.0 / current : ktorrent (SSA:2007-093-02)	Nessus	Slackware Local Security Checks	high
24797	FreeBSD : ktorrent -- multiple vulnerabilities (73f53712-d028-11db-8c07-0211d85f11fb)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2007-1384

high

Tenable Plugins

high

high

high

high

high

high