[USN-885-1] Transmission vulnerabilities

By | 2010/01/14

===========================================================
Ubuntu Security Notice USN-885-1           January 14, 2010
transmission vulnerabilities
CVE-2009-1757, CVE-2010-0012
===========================================================

It was discovered that the Transmission web interface was vulnerable to cross-site request forgery (CSRF) attacks. If a user were tricked into opening a specially crafted web page in a browser while Transmission was running, an attacker could trigger commands in Transmission. This issue affected Ubuntu 9.04. (CVE-2009-1757)

Dan Rosenberg discovered that Transmission did not properly perform input validation when processing torrent files. If a user were tricked into opening a crafted torrent file, an attacker could overwrite files via directory traversal. (CVE-2010-0012)

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 8.04 LTS:
transmission-cli                1.06-0ubuntu6.1
transmission-gtk                1.06-0ubuntu6.1

Ubuntu 8.10:
transmission-cli                1.34-0ubuntu2.3
transmission-gtk                1.34-0ubuntu2.3

Ubuntu 9.04:
transmission-cli                1.51-0ubuntu3.1
transmission-gtk                1.51-0ubuntu3.1

Ubuntu 9.10:
transmission-cli                1.75-0ubuntu2.2
transmission-gtk                1.75-0ubuntu2.2
transmission-qt                 1.75-0ubuntu2.2

After a standard system upgrade you need to restart Transmission to effect the necessary changes.

One thought on “[USN-885-1] Transmission vulnerabilities

Comments are closed.