Description
The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via a crafted HTTP POST request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ktorrent | 3.1.4+dfsg.1-1 | — |
| Debian 13 | ktorrent | 3.1.4+dfsg.1-1 | — |
| Debian 12 | ktorrent | 3.1.4+dfsg.1-1 | — |
References
- [oss-security] 20090108 CVE request: ktorrent mailing-list
- 31927 vdb-entry
- USN-711-1 vendor-advisory
- 32447 third-party-advisory
- 32442 third-party-advisory
- 34003 third-party-advisory
- GLSA-200902-05 vendor-advisory
- https://bugs.gentoo.org/show_bug.cgi?id=244741
- 33675 third-party-advisory
- http://ktorrent.org/?q=node/23
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504178
- ADV-2008-2911 vdb-entry
- ktorrent-webinterface-weak-security(46117) vdb-entry