Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Fedora 11: FEDORA-2009-6502 High-Risk rb_libtorrent Directory Access

fedora
Calendar Grey June 26, 2009
Dist Fedora Esm H88
Enhancement for rb_libtorrent to rectify directory traversal vulnerability, stopping potential unauthorized file overwrites caused by specially formed torrents.
This release adds an upstream patch to fix a directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a ".." (dot dot) and ...

Summary

rb_libtorrent is a C++ library that aims to be a good alternative to all

the other BitTorrent implementations around. It is a library and not a full

featured client, although it comes with a few working example clients.

Its main goals are to be very efficient (in terms of CPU and memory usage) as

well as being very easy to use both as a user and developer.

Update Information:

This release adds an upstream patch to fix a directory traversal vulnerability which would allow a remote attacker to create or overwrite arbitrary files via a ".." (dot dot) and partial relative pathname in a specially-crafted torrent.

Topics%20covered

Topics Covered

security advisory security issue software update Fedora directory traversal arbitrary file rb_libtorrent

Change Log

* Fri Jun 12 2009 Peter Gordon - 0.14.3-2 - Apply upstream patch to fix CVE-2009-1760 (arbitrary file overwrite vulnerability): + CVE-2009-1760.diff - Fixes security bug #505523. - Drop outdated Boost patch: - 0.13.1-boost.patch * Mon Apr 27 2009 Peter Gordon - 0.14.3-1 - Update to new upstream bug-fix release (0.14.3).

References


[ 1 ] Bug #505523 - CVE-2009-1760 rb_libtorrent: arbitrary file overwrite vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=505523

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update rb_libtorrent' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
important
Lowest
Low
Medium
High
Critical

Name: rb_libtorrent
Product: Fedora 11
Version: 0.14.3
Release: 2.fc11
URL: https://www.rasterbar.com/products/libtorrent/
Summary: A C++ BitTorrent library aiming to be the best alternative

Topics%20covered

Topics Covered

security advisory security issue software update Fedora directory traversal arbitrary file rb_libtorrent

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here