Bug: BitComet URI Buffer Overflow Vulnerability ( Ascii Version )

Search:
WLB2

BitComet URI Buffer Overflow Vulnerability

Published
Credit
Risk
2006.01.19
Fortinet Research
High
CWE
CVE
Local
Remote
N/A
CVE-2006-0339
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

Fortinet Security Advisory: FSA-2006-07

BitComet URI Buffer Overflow Vulnerability

Advisory Date : January 18, 2006
Reported Date : November 29, 2005
Vendor : BitComet
Affected Products : BitComet v0.60
Severity : High
Reference : http://www.bitcomet.com/doc/download.htm

Description : Fortinet Security Research Team (FSRT) has
discovered a URI buffer overflow Vulnerability in the BitComet P2P Client
software. It indicates a possible exploit of buffer overflow vulnerability
in BitComet. BitComet is one of the most popular P2P Client for file
sharing, which uses bittorrent protocol. There is a bug in BitComet, a
remote attacker could construct a special .torrent file and put it on any
bt publish web site. When a user downloads the .torrent file and clicks on
publishers name, BitComet will crash. An attacker can run arbitrary
Command on victims host by specially crafted .torrent file.

Impact : Execute arbitrary code

Solution : BitComet has released a update for this
vulnerability, which is available for downloading from BitComet's web
site.

Fortinet Protection: FortiGate series of security systems have been
updated to detect exploits targeting this vulnerability.

Acknowledgment : Dejun Meng of Fortinet Security Research team found
this vulnerability.

Disclaimer : Although Fortinet has attempted to provide accurate
information in these materials, Fortinet assumes no legal responsibility
for the accuracy or completeness of the information. More specific
information is available on request from Fortinet. Please note that
Fortinet's product information does not constitute or contain any
guarantee, warranty or legally binding representation, unless expressly
identified as such in a duly signed writing.

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version