1. Ubuntu Security Notices
  2. USN-711-1

USN-711-1: KTorrent vulnerabilities

Publication date

26 January 2009

Overview

KTorrent vulnerabilities

Releases

Packages

Details

It was discovered that KTorrent did not properly restrict access when using the
web interface plugin. A remote attacker could use a crafted http request and
upload arbitrary torrent files to trigger the start of downloads and seeding.
(CVE-2008-5905)

It was discovered that KTorrent did not properly handle certain parameters when
using the web interface plugin. A remote attacker could use crafted http
requests to execute arbitrary PHP code. (CVE-2008-5906)

It was discovered that KTorrent did not properly restrict access when using the
web interface plugin. A remote attacker could use a crafted http request and
upload arbitrary torrent files to trigger the start of downloads and seeding.
(CVE-2008-5905)

It was discovered that KTorrent did not properly handle certain parameters when
using the web interface plugin. A remote attacker could use crafted http
requests to execute arbitrary PHP code. (CVE-2008-5906)

Update instructions

After a standard system upgrade you need to restart KTorrent to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
8.10 intrepid ktorrent –  3.1.2+dfsg.1-0ubuntu2.1
8.04 hardy ktorrent –  2.2.5-0ubuntu1.1
7.10 gutsy ktorrent –  2.2.1-0ubuntu3.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›