Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Fedora: 2009-6547 Critical: rb_libtorrent Directory Traversal Risk

fedora
Calendar Grey June 26, 2009
Dist Fedora Esm H88
Correction for directory traversal vulnerability in rb_libtorrent that permits remote file replacement. Upgrade your Fedora system immediately.
This release adds an upstream patch to fix a directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a ".." (dot dot) and ...

Summary

rb_libtorrent is a C++ library that aims to be a good alternative to all

the other BitTorrent implementations around. It is a library and not a full

featured client, although it comes with a few working example clients.

Its main goals are to be very efficient (in terms of CPU and memory usage) as

well as being very easy to use both as a user and developer.

Update Information:

This release adds an upstream patch to fix a directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a ".." (dot dot) and partial relative pathname in a specially-crafted torrent.

Topics%20covered

Topics Covered

security advisory critical Fedora directory traversal arbitrary overwrite rb_libtorrent

Change Log

* Sun Jun 14 2009 Peter Gordon - 0.13.1-5 - Apply upstream patch to fix CVE-2009-1760 (arbitrary file overwrite vulnerability): + 0.13-CVE-2009-1760.diff - Fixes security bug #505523. * Mon Jan 5 2009 Peter Gordon - 0.13.1-4 - Add asio-devel as runtime dependency for the devel subpackage (#478589) * Thu Nov 20 2008 Peter Gordon - Update Source0 URL, for now.

References


[ 1 ] Bug #505523 - CVE-2009-1760 rb_libtorrent: arbitrary file overwrite vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=505523

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update rb_libtorrent' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: rb_libtorrent
Product: Fedora 10
Version: 0.13.1
Release: 5.fc10
URL: https://www.rasterbar.com/products/libtorrent/
Summary: A C++ BitTorrent library aiming to be the best alternative

Topics%20covered

Topics Covered

security advisory critical Fedora directory traversal arbitrary overwrite rb_libtorrent

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here