this post was submitted on 31 Oct 2024
76 points (100.0% liked)

Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

1445 readers
8 users here now

⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.

Rules • Full Version

1. Posts must be related to the discussion of digital piracy

2. Don't request invites, trade, sell, or self-promote

3. Don't request or link to specific pirated titles, including DMs

4. Don't submit low-quality posts, be entitled, or harass others



Loot, Pillage, & Plunder

📜 c/Piracy Wiki (Community Edition):


💰 Please help cover server costs.

Ko-Fi Liberapay
Ko-fi Liberapay

founded 1 year ago
MODERATORS
 

I dont know who needs to hear this bit qBittorrent has a nasty vulnerability ( and there are some older ones too)

qBittorrent, on all platforms, did not verify any SSL certificates in its DownloadManager class from 2010 until October 2024. If it failed to verify a cert, it simply logged an error and proceeded.

To be exploitable, this bug requires either MITM access or DNS spoofing attacks, but under those conditions (seen regularly in some countries), impacts are severe.

The primary impact is single-click RCE for Windows builds from 2015 onward, when prompted to update python the exe is downloaded from a hardcoded URL, executed, and then deleted afterwards.

The secondary impact for all platforms is the update RSS feed can be poisoned with malicious update URLs which the user will open in their browser if they accept the prompt to update. This is browser hijacking and arbitrary exe delivery to a user who would likely trust whatever URL this software sent them to.

The tertiary impact is this means that an older CVE (CVE-2019-13640 https://www.cvedetails.com/cve/CVE-2019-13640/) which allowed remote command execution via shell metacharacters could have been exploited by (government) attackers conducting either MITM or DNS spoofing attacks at the time, instead of only by the author of the feed.

Full write up is here: https://sharpsec.run/rce-vulnerability-in-qbittorrent/

top 11 comments
sorted by: hot top controversial new old
[–] AmbiguousProps@lemmy.today 44 points 3 weeks ago* (last edited 3 weeks ago) (1 children)

If you are running Windows [...]

and

from June 2015 until the present, affecting v3.2.1 through v5.0.0 inclusive. The behaviour does not appear to be replicated for other OS variants

[–] Kissaki@lemmy.dbzer0.com 11 points 3 weeks ago* (last edited 3 weeks ago)

Notably, 5.0.1 was released three days ago. So a fix is available.

The first patched release is version 5.0.1, released 2 days ago.

[–] Supermariofan67@programming.dev 12 points 3 weeks ago

Perfect example of a (part of a) security vulnerability being fixed in a commit that doesn't immediately seem security related and would never be back ported to a ~~stable~~stale distro

The code which parses the binary MaxMind database after decompression is well guarded as of 2024 but used to look different, potentially providing more attack surface. There is also an interesting commit where a contributor makes adjustments to the gzip::decompress() function which hints at a stack overflow, as the destination buffer was changed from static allocation on the stack to dynamic allocation on the heap, though it was not exploitable due to checks before it is written to

[–] navi@lemmy.tespia.org 11 points 3 weeks ago

Containerization helps, but best to patch asap.

[–] JCPhoenix 8 points 3 weeks ago* (last edited 3 weeks ago) (2 children)

Mitigations

Just use another torrent client. Deluge and Transmission etc do not have this vulnerability.

Was wondering what the takeaway is here. I updated to 5.0.1. Does that fix all these? If not, guess I'll try a different torrent client.

[–] ArtikBanana@lemmy.dbzer0.com 14 points 3 weeks ago

The first patched release is version 5.0.1, released 2 days ago.

[–] ReversalHatchery 8 points 3 weeks ago

yeah, they have other undiscovered vulnerabilities

[–] rolandtb303@lemmy.ml 6 points 3 weeks ago (1 children)

i kinda wish that some people who post security vulns stop being so vague and cherry-picky sometimes, like you could have written in your post that it only affects windows and it affects only a certain range of versions of the program. would have clearned things up better imo. interesting to know, though.

[–] ShortN0te@lemmy.ml 6 points 3 weeks ago

You should have read the post more carefully. The CVE affects every OS. Just the first shown example is Windows only.

Also, the relevant commits are outlined in the first paragraph. This article is not for the stupid user it's a technical analysis on a few ways to exploit it and for those cases the commits are more relevant than the version. Also saying which versions are affected is not that easy, commits can be backported into an older version by for example the packager.

[–] Churbleyimyam@lemm.ee 2 points 3 weeks ago (2 children)

Will I be OK updating from the Debian repo?

[–] N0x0n@lemmy.ml 7 points 3 weeks ago* (last edited 3 weeks ago)

From another poster above, it seems only Windows machines are affected.

load more comments (1 replies)