Your message dated Sat, 03 Apr 2010 16:01:56 +0200
with message-id <4bb74a54....@debian.org>
and subject line Re: Bug#576331: Transmission 1.92 fixes two security issues
has caused the Debian Bug report #576331,
regarding Transmission 1.92 fixes two security issues
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
576331: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576331
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: transmission
Severity: grave
Tags: security
The message below was reported on oss-security. CVE-2010-0749 seems
like a regular bug to me, not necessarily security-relevant, but
please upload transmission 1.92 ASAP.
Lenny isn't affected, it doesn't have support for Magnet links yet.
On a side note: Given that most Bittorrent trackers seem to block
older clients, I think we should change the update policy for Squeeze
and always introduce the recent version in stable point updates.
What do you think?
Cheers,
Moritz
> Transmission upstream has recently released latest, v1.92 version:
> [1] http://trac.transmissionbt.com/wiki/Changes
>
> fixing one (potentially two) security issues:
> a, Fix potential buffer overflow when adding maliciously-crafted
> magnet links
>
> References:
> [2] http://trac.transmissionbt.com/ticket/2965
> [3] http://trac.transmissionbt.com/wiki/Changes
> [4] http://bugs.gentoo.org/show_bug.cgi?id=309831
> Use CVE-2010-0748 for this one. I'm calling it an arbitrary memory write.
> It's not really a buffer overflow.
> b, Fix possible data corruption issue caused by data sent by bad
> peers during endgame (this one I am not completely sure of, but when
> looking at the relevant bug record:
> [5] http://trac.transmissionbt.com/ticket/1242
> there is written:
> [6] http://trac.transmissionbt.com/ticket/1242#comment:1
> "My theory is that for some reason Transmission will download a
> corrupt part from someone but not realize it until you do a
> manual verify. At this point T will recognize the bad part and
> redownload it from the same person, which just causes the
> problem again."
>
> so to prevent someone from successfully downloading content of
> some torrent file, for an attacker to should be enough to
> download a part of it, corrupt it and
> share it. Not sure about the algorithm, Transmission decides
> which torrent
> to retrieve content from, but if it is deterministic /
> predictable behavior / algorithm, such attack could succeed).
>
> References:
> [7] http://trac.transmissionbt.com/ticket/1242
> [8] http://trac.transmissionbt.com/ticket/1242#comment:1
> [9] http://trac.transmissionbt.com/wiki/Changes
>
> I'm giving this issue a CVE ID too. I think this issue is a bit on the
> fence, but given a malicious client could corrupt download data in a manner
> that is hard to fix, it should get one.
> Use CVE-2010-0749
-- System Information:
Debian Release: squeeze/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.32-3-686 (SMP w/1 CPU core)
Locale: LANG=C, lc_ctype=de_de.iso-8859...@euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash
Versions of packages transmission depends on:
pn transmission-cli <none> (no description available)
pn transmission-common <none> (no description available)
pn transmission-gtk <none> (no description available)
transmission recommends no packages.
transmission suggests no packages.
--- End Message ---
--- Begin Message ---
Version: 1.92-1
Moritz Muehlenhoff wrote:
> The message below was reported on oss-security. CVE-2010-0749 seems
> like a regular bug to me, not necessarily security-relevant, but
> please upload transmission 1.92 ASAP.
>
It's already been uploaded a couple of days ago and is just waiting for
the current ftp-master outage to settle down to finally hit the archive.
> On a side note: Given that most Bittorrent trackers seem to block
> older clients, I think we should change the update policy for Squeeze
> and always introduce the recent version in stable point updates.
> What do you think?
AFAICT, the blocks affect just known-buggy versions (since I still see
so many 1.22 and other older versions in the wild), so this should only
be an option if the released version happens to be one of those. As a
general rule, I'd very much refrain from it to avoid introducing even
more bugs in stable point releases.
Cheers
--
Leo "costela" Antunes
[insert a witty retort here]
--- End Message ---
