Description
The Web UI interface in (1) BitTorrent before 6.0.3 build 8642 and (2) uTorrent before 1.8beta build 10524 allows remote attackers to cause a denial of service (application crash) via an HTTP request with a malformed Range header.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- μTorrent (uTorrent) / BitTorrent WebIU HTTP 1.7.7/6.0.1 - Range header Denial of Service EDB-5918 · dos · Jun 23, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 3943 third-party-advisory
- 28703 third-party-advisory
- http://secunia.com/secunia_research/2008-7/advisory/
- 29661 vdb-entry
- ADV-2008-1809 vdb-entry
- 30605 third-party-advisory
- ADV-2008-1808 vdb-entry
- 1020266 vdb-entry
- 20080611 Secunia Research: uTorrent / BitTorrent Web UI HTTP "Range" Header DoS mailing-list
- 1020265 vdb-entry
- 5918 exploit