uTorrent vulnerabilities allow information disclosure and remote code execution

Users of the file-sharing app were left exposed for several hours while the bug was public and a new security patch didn't quite work. A new and effective patch was delivered soon afterward.

A BitTorrent client with more than 100 million users suffered numerous critical vulnerabilities including remote code execution and copying downloaded files, according to new information from Google’s Project Zero. Users were left exposed for several hours on Tuesday when the bug was public and a new security patch didn’t quite work. A new and effective patch was delivered Tuesday night.

Google security researcher Tavis Ormandy informed BitTorrent Inc. of the issues with the uTorrent client in December 2017.

A patch was made public early Tuesday but Ormandy says that, after a small tweak, his exploits continued to work in the default configuration.

“This issue is still exploitable,” Ormandy explained. “The vulnerability is now public because a patch is available, and BitTorrent have already exhausted their 90 days anyway. I see no other option for affected users but to stop using uTorrent Web and contact BitTorrent and request a comprehensive patch.”

On late Tuesday night, BitTorrent Inc.’s Vice President of Engineering David Reese said the company released uTorrent Web version 0.12.0.502 that ultimately fixed the issue. All users are urged to update now.

BitTorrent’s software, including uTorrent, allows users to share and access files on the open internet. By default, uTorrent — an adware version of the sharing protocol —  is configured to launch on startup with Windows so it the vulnerable application is by design always running. The uTorrent software essentially creates a server on a user’s machine that uses BitTorrent’s protocol to allow file-sharing.

The unpatched version of the server contained vulnerabilities that could be exploited through any website by basic requests — so basic that Ormandy called them “so trivial.”

“By default, utorrent create an HTTP RPC server on port 10000 (uTorrent classic) or 19575 (uTorrent web),” Ormandy wrote. “There are numerous problems with these RPC servers that can be exploited by any website using XMLHTTPRequest(). To be clear, visiting *any* website is enough to compromise these applications.”

A website could steal a target authentication secret in order to gain complete control of a victim’s uTorrent service as well as gain access to logs, settings and a variety of other data.

Update: Ormandy’s new comments about the exploits continuing to work despite the patch have been added. David Rees’s news about the latest patch have been added as well.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure