Attention uTorrent and BitTorrent users!

[U2Lynne]

From here: http://torrentfreak.com/bittorrent-c...attack-080117/

uTorrent and Official BitTorrent Client Vulnerable to Remote DOS Attack
Written by enigmax on January 17, 2008

Both the official BitTorrent and uTorrent clients are vulnerable to a remote denial-of-service attack, due to the way they handle user-supplied data. Versions found to be vulnerable so far are the official BitTorrent 6.0 client, uTorrent 1.7.x, uTorrent 1.6.x and uTorrent 1.8-alpha-7834.

Security vulnerabilities in BitTorrent clients are relatively rare, although not unheard of. Luigi Auriemma, a Milan-based security expert, claims to have found a vulnerability in various BitTorrent clients based on the way they handle user-supplied data. The flaw allows an attacker to crash the application, effectively denying service to legitimate users. Code execution is not possible, which means there is little reason for users to panic.

So far, the problem appears to affect these clients:

- BitTorrent 6.0 (build 5535)
- uTorrent 1.7.5 (build 4602)
- uTorrent 1.8 (alpha 7834)

Luigi is reporting that earlier versions of these clients may also be vulnerable and this appears to have been confirmed by the uTorrent team. The problems are confirmed to exist on Windows versions of the software. As yet, Mac and Linux versions of the official BitTorrent client have not been tested.

The bug in detail (from Luigi’s site):

The uTorrent team state the flaw affects all older uTorrent versions 1.6 and 1.7.x. too but have been quick to respond, releasing a new build - uTorrent 1.7.6 (build 7859) which has fixed the issue.

It can be downloaded here.

edit 2008-01-27: Newest utorrent is 1.7.7: http://download.utorrent.com/1.7.7/utorrent.exe

[paddington]

[Salva Veritate]

Doesn't utorrent 1.7.x report your download information or something? Or was that some paranoid/exaggerated rumor?

[bartmanus]

It is only a paranoid rumor.

Doesn't the RIAA (who sues some P2P users) use clients to vew who connects to tem? That way they get users inetrnet addresses which they can then get warrants for ISPs to link to customers.

All clients are vulnerable to such an 'attack'. But AFAIK RIAA has only sued Kazaa users while they continually try to bring down ed2k portals and torrent hosting sites.

[rosc2112]

Crash bugs from buffer overruns are pretty common (and symptomatic of programmers who don't know what bounds checking is for..)

[lbeatle]

My uTorrent client has been upgraded.

[datdork]

seems that 1.6 is fine. 1.6.1 build 190 is the most stable and I'm not about to "upgrade" to 1.76 call me paranoid if ya won't but I haven't trusted them since 1.7X



many many dorks have tried/tested the crash exploit on all versions and this is what they came up with.

1.6.0 (474) fine (but vulnerable to exploit1)
1.6.1 (488) fine
1.6.1 (489) fine
1.6.1 (490) fine
1.7.0 (3353) bugged
1.7.1 (3360) bugged
1.7.2 (3458) bugged
1.7.3 (4470) bugged
1.7.4 (4482) bugged
1.7.5 (4602) bugged

[saltman]

Try Halite

http://sourceforge.net/project/scree...roup_id=179129
http://sourceforge.net/project/showf...roup_id=179129

[dannyandamie]

What is RIAA? WHat is P2P? Do they really get IP addys and sue? What torrent should I use?
What does U2Lynne use? What does Dylan use? You guys are great!

[rosc2112]

Originally Posted by dannyandamie

What is RIAA? WHat is P2P? Do they really get IP addys and sue? What torrent should I use?
What does U2Lynne use? What does Dylan use? You guys are great!

Go back to sleep.

[dannyandamie]

Originally Posted by rosc2112

Go back to sleep.

Meaning???

[dannyandamie]

Originally Posted by rosc2112

Go back to sleep.

I'm not sure that this answered any of my questions..?/?

[U2Lynne]

Originally Posted by dannyandamie

I'm not sure that this answered any of my questions..?/?

I'm on a Mac and use Azureus, so this notice didn't affect me, but I know that many of the users on this site use uTorrent which is why this was posted.

[dementrium]

Ironically, these are very good news to me. Why? Because, now I can connect the dots to what probably happened to me in December.

The symptoms, so far...

The torrents happened to stop with an O.S. error msg. Something like "insufficient resources to complete the requested command".
Also, the other applications where affected too. Windows was unable to even display the some desktop icons. All in all, the system was dragging on its knees.
Reboot. Started (the same) torrents again. After a few minutes, the same thing.

It seemed that the problem wasn't related to RAM or HD resources.

After some checking, I was totally clueless. So, did what I call a PSM (Placebo System Maintenance).

This time the PSM consisted of freeing some HD space, backuping/erasing all torrent activity. So, I started torrenting again from zero, with new torrents. The problem didn't happen again. (Dots connected with the issue mentioned here... I hope ).

I will not upgrade at this moment, just to see if this happen again.

Thank you, people, for this info.

[tgunn2760]

Originally Posted by bartmanus

It is only a paranoid rumor.

Doesn't the RIAA (who sues some P2P users) use clients to vew who connects to tem? That way they get users inetrnet addresses which they can then get warrants for ISPs to link to customers.

All clients are vulnerable to such an 'attack'. But AFAIK RIAA has only sued Kazaa users while they continually try to bring down ed2k portals and torrent hosting sites.

I always have this on, even when downloading legal bootlegs:


http://phoenixlabs.org/pg2/