Google's safety researcher at Project Zero discovered a serious remote code execution vulnerability inwards both the 'μTorrent desktop app for Windows' in addition to newly launched 'μTorrent Web' that allows users to download in addition to flow torrents straight into their spider web browser.
μTorrent Classic in addition to μTorrent Web apps run inwards the background on the Windows car in addition to get-go a locally hosted HTTP RPC server on ports 10000 in addition to 19575, respectively, using which users tin access its interfaces over whatever spider web browser.
However, Project Zero researcher Tavis Ormandy works life that several issues amongst these RPC servers could let remote attackers to receive got command of the torrent download software amongst petty user interaction.
According to Ormandy, uTorrent apps are vulnerable to a hacking technique called the "domain cite arrangement rebinding" that could let whatever malicious website a user visits to execute malicious code on user's calculator remotely.
"This requires around uncomplicated DNS rebinding to laid on remotely, but ane time you lot receive got the surreptitious you lot tin exactly alter the directory torrents are saved to, in addition to and thence download whatever file anywhere writable," Ormandy explained.
Proof-of-Concept Exploits for uTorrent Software Released Publicly
Last month, Ormandy demonstrated same laid on technique against the Transmission BitTorrent app.
Ormandy reported BitTorrent of the issues amongst the uTorrent customer inwards Nov 2017 amongst a 90-days disclosure deadline, but a spell was made populace on Tuesday—that's around fourscore days later on the initial disclosure.
What's more? The re-issued novel safety patches the same twenty-four threescore minutes catamenia later on Ormandy works life that his exploits continued to run successfully inwards the default configuration amongst a pocket-size tweak.
"This consequence is even thence exploitable," Ormandy said. "The vulnerability is at nowadays populace because a spell is available, in addition to BitTorrent receive got already exhausted their ninety days anyway."
"I run into no other selection for affected users but to terminate using uTorrent Web in addition to contact BitTorrent in addition to asking a comprehensive patch."
Patch your uTorrent Software NOW!
The companionship assured its users that all vulnerabilities reported yesteryear Ormandy it 2 of its products had been addressed amongst the liberate of:
- μTorrent Stable 3.5.3.44358
- BitTorrent Stable 7.10.3.44359
- μTorrent Beta 3.5.3.44352
- μTorrent Web 0.12.0.502
All users are urged to update their software immediately.
