µTorrent exploit revealed

[torrentslave]

http://www.zeropaid.com/bbs/../news/upload/images/thumb/8400.jpgAccording to IT security experts, the latest version of uTorrent is vulnerable to remote exploits.

Today brings news that the popular BitTorrent client server uTorrent (http://www.zeropaid.com/bbs/../news/6184/uTorrent+-+A+Beginner%27s+guide+to+BitTorrent+downloading) is vulnerable to hackers that can infiltrate your PC and execute arbitr ary code if a user opens a manipulated torrent tracker file.

The apparent "glitch" in the software is that torrent tracker fields may contain an "announce" field. Well, if this "announce" field is longer than 4800 bytes, an internal µTorrent (http://www.zeropaid.com/bbs/../news/6184/uTorrent+-+A+Beginner%27s+guide+to+BitTorrent+downloading) buffer overflows, thereby allowing hackers to run their exploits.

For now it's only µTorrent 1.6 build 474 that is affected but, older versions may also contain the bug, and a new version to fix the problem is not yet available.

http://filesharingtalk.com/vb3/images/smilies/news_source.gif Source: http://digg.com/tech_news/mTorrent_gets_hacked_Remote_exploit_revealed

__________________________________________________

got this info on another forum

[gamer4eva]

That sucks.....going to switch now!!!!

[Niteghost]

Just lost my appetite, SUCKS bigtime, I guess Azueus:( :( :( :( :( :( :(

[Jab]

Apparently works on XP SP1 and w2k sp1-4

[gamer4eva]

Well it only affects those with announce higher than 4800bytes whatever that means.....

[Acidice]

hmm... how prominent is this? I really don't wanna switch to the cpu-consuming AZ :(

[gamer4eva]

hmm... how prominent is this? I really don't wanna switch to the cpu-consuming AZ :(

Neither do i......:(

[Shadowfire]

Heh, and with this, uT does downhill ........

[gamer4eva]

Heh, and with this, uT does downhill ........

Utorrent began to go downhill when it sold out....:lol:

[torrentslave]

yep sucks big harry balls!!!!

[DefX]

this is very upsetting. what are good alternatives out there aside from azureus? Something that doesnt consume lots of RAM.

[Alien5]

wait for the fix.

[Jaits]

the tracker owners can perform the fix in the tracker to not allow the faulty torrent to be uploaded.... u shouldnt really be opening torrents that other ppl send u anyhow...

the current shellcode doesnt affect sp2 so most users will be safe....

[vali]

the tracker owners can perform the fix in the tracker to not allow the faulty torrent to be uploaded.... u shouldnt really be opening torrents that other ppl send u anyhow...

the current shellcode doesnt affect sp2 so most users will be safe....



..........Safe? The only sharing that is safe, is the hand to hand sharing.

LOL

[abu_has_the_power]

this shouldn't be a problem if you get your torrents from legit sites

[nebcat]

Oh my god! Switching...Thanks for the heads up!

[erRor67]

The latest beta fixes this problem.

[ewerest]

"it only affects those with announce higher than 4800bytes"
and this kind of .torrent files are produced by porposely to hack you.so in the private trackers there is no need to worry about.

[Sentient]

Heh, and with this, uT does downhill ........

Jesus, there's overreacting and then there's you guys. It doesn't even affect the latest build.

[S!X]

ah excellent news.. they need a new final build in the works asap...

[4play]

It really should be a simple fix for this. Im just wondering why there isnt a new version out already.

[vipdiablo]

yep sucks

[biggrizz]

This is a bit worrying.I hope something is done soon

[Appzalien]

I'd heard that some devious character took over the utorrent servers and I remember commenting to the poster and replyers that it didn't matter because utorrent didn't automatically update itself, you would have to download a new version created by this new owner to be vulnerable. And as long as you remained at the last version before he took over you should be ok.

Now that I hear utorrent itself warning customers that "if you know whats good for you you better update" I'm skeptical that a hole even exists. If the posters from before were indeed right, and this guy is devious, then this warning sounds devious as well. I don't know which is worse using an app with a security hole that has never been exploited (although it probably will be now!) or updating to a new version perhaps created with the mpaa and riaa's blessing for all I know.

The third option seems best to me, dump utorrent and use a different p2p client.

[Hairbautt]

Check nsane, µTorrent 1.6.1.488 Final (http://www.nsaneproductions.com/forums/?showtopic=5525). Besure to subscribe to thread.

[mr. nails]

488 is released now. meh, i'll update sometime. lol, why are all u worried? do u save credit card numbers and/or bank account numbers on ur pc? if not.. what's the prob?

- Feature: Select upload/download speed for a torrent through the rightclick menu
- Feature: Added encryption box to speed guide
- Change: Don't check as many pieces at the same time.
- Change: Misc WebUI changes.
- Change: Switch to JSON for webinterface
- Fix: Problem with category list in the gui when updated from the webui
- Fix: WebUI not clearing state between requests.
- Fix: Redirect also index.html to guest.html
- Fix: Added On Now shows the time it's added, not loaded.
- Fix: JSON uses " instead of '
- Fix: (a) Upnp fix
- Fix: Show pause icon when checking is paused.
- Fix: Fixed problems with XML parser
- Fix: Don't allow two message boxes to be shown in the RSS window
- Fix: Changed some window titles
- Fix: Fix malformed .torrent exploit
- Fix: Boss key field is now larger

[Exploit]

yeahh but still a beta :(

[mr. nails]

yeahh but still a beta :(

it's official. not beta. just cuz it's not on the utorrent site yet doesn't mean it's beta. lol, i have my resources. u'll see.

[Hairbautt]

yeahh but still a beta :(
It's posted and says "Final" :unsure:

[reachnet]

I'd heard that some devious character took over the utorrent servers and I remember commenting to the poster and replyers that it didn't matter because utorrent didn't automatically update itself, you would have to download a new version created by this new owner to be vulnerable. And as long as you remained at the last version before he took over you should be ok.

Now that I hear utorrent itself warning customers that "if you know whats good for you you better update" I'm skeptical that a hole even exists. If the posters from before were indeed right, and this guy is devious, then this warning sounds devious as well. I don't know which is worse using an app with a security hole that has never been exploited (although it probably will be now!) or updating to a new version perhaps created with the mpaa and riaa's blessing for all I know.

The third option seems best to me, dump utorrent and use a different p2p client.

That's one of the best examples of "brain-FUD" I think I've ever seen. Congrats ! ;)
To believe or not to believe that is the question. ;)
If it's all the same with you, I think I'll upgrade anywayz ! ;)

[erRor67]

yeahh but still a beta :(

it's official. not beta. just cuz it's not on the utorrent site yet doesn't mean it's beta. lol, i have my resources. u'll see.
Yes, its a final build. Download it here: http://download.utorrent.com/1.6.1/utorrent.exe

And just so you guys know, this exploit was fixed in a beta build back in July 2006. ;)

[mr. nails]

I'd heard that some devious character took over the utorrent servers and I remember commenting to the poster and replyers that it didn't matter because utorrent didn't automatically update itself, you would have to download a new version created by this new owner to be vulnerable. And as long as you remained at the last version before he took over you should be ok.

Now that I hear utorrent itself warning customers that "if you know whats good for you you better update" I'm skeptical that a hole even exists. If the posters from before were indeed right, and this guy is devious, then this warning sounds devious as well. I don't know which is worse using an app with a security hole that has never been exploited (although it probably will be now!) or updating to a new version perhaps created with the mpaa and riaa's blessing for all I know.

The third option seems best to me, dump utorrent and use a different p2p client.

stole the quote....

yep, exactly. probably why i'll be installing azureus again anyhow. as, i've not yet intalled this "new" version of utorrent and i mite not.

[lynx]

This exploit is officially fixed in 1.6.1 build 489, released yesterday.

As erRor67 says, rumour is that it was actually fixed (as a tidying of the code) in the initial release of the Beta back in July 2006, but they hadn't thought of it as a vulnerability so it wasn't mentioned until now.

I've been using the Beta since then and I'm very happy with it, the changes in this final release are minimal and nothing to do with the sellout to bittorrent.

[Chip Monk]

Cheers for the info, lynx.

Is it best to remove an older version then do a fresh install or is it OK to just download the installer and run it.

[kabloomz]

Cheers for the info, lynx.

Is it best to remove an older version then do a fresh install or is it OK to just download the installer and run it.


fresh install... dont forget to remember ur settings (if u use any other than default)...

Kab

[Hairbautt]

Cheers for the info, lynx.

Is it best to remove an older version then do a fresh install or is it OK to just download the installer and run it.


fresh install... dont forget to remember ur settings (if u use any other than default)...

Kab
You can backup the the settings in the docs&settings/applicationdata/utorrent

[mr. nails]

this final release are minimal and nothing to do with the sellout to bittorrent.

how do u know?

[Hairbautt]

At nsane:



So, safe to use after µtorrent joinup with bittorrent?

Bittorrent, Inc bought the right to use uTorrent's core. They do not own uTorrent, or have any power to interfere with the development.

I just keep checking to see if anyone has problems, so far none.

[mike7778]

HAS anyone had any problems with Utorrent?

[S!X]

Cheers for the info, lynx.

Is it best to remove an older version then do a fresh install or is it OK to just download the installer and run it.

I just replaced my .exe file in the installation directory since this version doesn't have an installer.

[mr. nails]

no official release in about a year and now 3 releases in 3 days. 490 is out. lol, have fun.

[Jaits]

the tracker owners can perform the fix in the tracker to not allow the faulty torrent to be uploaded.... u shouldnt really be opening torrents that other ppl send u anyhow...

the current shellcode doesnt affect sp2 so most users will be safe....



..........Safe? The only sharing that is safe, is the hand to hand sharing.

LOL

maybe for u in terms of ur reality.... which i guess is quite limited....

[Washy]

Has the issue been resolved with the latest release?

W.

[mr. nails]

Has the issue been resolved with the latest release?

W.

i was never having an issue with version 1.6 build 474. i won't be updating anytime soon either. also, my build i'm using works with windows vista ultimate 64bit edition for those who need to know.

[tailz]

Switch!

[durex]

HAS anyone had any problems with Utorrent?

no problems, so far ...
:)