August 18th, 2008
uTorrent silently patches critical vulnerability
If uTorrent is the client you use to download files, now might be a good time to hit that “check for updates” button.
According to security alerts aggregator Secunia, there’s a “highly critical” uTorrent vulnerability that could allow remote code execution attacks with rigged .torrent files.
From the advisory:
- The vulnerability is caused due to a boundary error in the processing of “.torrent” files. This can be exploited to cause a stack-based buffer overflow by tricking the user into opening a “.torrent” file containing an overly long “created by” field.
- Successful exploitation may allow execution of arbitrary code.
- The vulnerability is confirmed in version 1.7.7 (build 8179). Prior versions may also be affected.
The issue was silently patched by the vendor in version 1.8 RC7. Rhys Kidd says the flaw is at least two years old.
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
