Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Gentoo: GLSA-201703-06 Critical: Deluge Remote Execution of Code

gentoo
Calendar Grey March 28, 2017
Scroller Gentoo
Vulnerability in Deluge facilitates remote command execution, enabling malicious entities to run unauthorized code. All impacted users are advised to perform an upgrade.
A vulnerability in Deluge might allow remote attackers to execute arbitrary code.

Summary

A CSRF vulnerability was discovered in the web UI of Deluge.

Topics%20covered

Topics Covered

security advisory update gentoo arbitrary code execution remote attack CSRF

Resolution

All Deluge users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-p2p/deluge-1.3.14"

References

[ 1 ] CVE-2017-7178 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7178

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201703-06
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
critical
Lowest
Low
Medium
High
Critical

Severity: Normal
Title: Deluge: Remote execution of arbitrary code
Date: March 28, 2017
Bugs: #612144
ID: 201703-06

Topics%20covered

Topics Covered

security advisory update gentoo arbitrary code execution remote attack CSRF

Synopsis

A vulnerability in Deluge might allow remote attackers to execute arbitrary code.

Background

Deluge is a BitTorrent client.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-p2p/deluge < 1.3.14 >= 1.3.14

Impact

===== A remote attacker could entice a user currently logged in into Deluge web UI to visit a malicious web page which uses forged requests to make Deluge download and install a Deluge plug-in provided by the attacker. The plug-in can then execute arbitrary code as the user running Deluge.

Workaround

There is no known workaround at this time.