uTorrent “announce” Option Buffer Overflow

uTorrent is a popular BitTorrent client.

Secunia published a critical advisory for uTorrent:

http://secunia.com/advisories/24130/

Description:
defsec has discovered a vulnerability in uTorrent, which can be exploited by malicious people to compromise a user’s system.

The vulnerability is caused due to a boundary error when processing “.torrent” files and can be exploited to cause a stack-based buffer overflow via a specially crafted “.torrent” file with an overly long (greater than 4800 bytes) “announce” option.

Successful exploitation allows execution of arbitrary code.

The vulnerability is confirmed in version 1.6 build 474. Other versions may also be affected.

Solution:
Do not open untrusted .torrent files.

Provided and/or discovered by:
defsec

Original Advisory:
http://milw0rm.com/exploits/3296

Leave a Comment

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top