Lucene search

Ubuntu.comUB:CVE-2009-1757

HistoryMay 22, 2009 - 12:00 a.m.

CVE-2009-1757

2009-05-2200:00:00

ubuntu.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

35.7%

JSON

Cross-site request forgery (CSRF) vulnerability in Transmission 1.5 before
1.53 and 1.6 before 1.61 allows remote attackers to hijack the
authentication of unspecified victims via unknown vectors.

Notes

Author	Note
jdstrand	8.04 LTS does not provide a web interface 9.04 switched http implementations from shttpd to evhttpd. As a result, the upstream patch is not valid on 8.10 and a new patch needs to be written from scratch. The web interface in 8.10 is considered beta and is disabled by default. The web interface must be enabled and the user must be tricked into navigating his/her browser to a malicious site while transmission is running.

Author

Note

jdstrand

8.04 LTS does not provide a web interface 9.04 switched http implementations from shttpd to evhttpd. As a result, the upstream patch is not valid on 8.10 and a new patch needs to be written from scratch. The web interface in 8.10 is considered beta and is disabled by default. The web interface must be enabled and the user must be tricked into navigating his/her browser to a malicious site while transmission is running.

OSVersionArchitecturePackageVersionFilename
ubuntu9.04noarchtransmission< 1.51-0ubuntu3.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	9.04	noarch	transmission	< 1.51-0ubuntu3.1	UNKNOWN

References

skeptikal.org/2009/05/owning-ubuntu-with-csrf.html

www.transmissionbt.com/index.php

launchpad.net/bugs/cve/CVE-2009-1757

nvd.nist.gov/vuln/detail/CVE-2009-1757

security-tracker.debian.org/tracker/CVE-2009-1757

ubuntu.com/security/notices/USN-885-1

www.cve.org/CVERecord?id=CVE-2009-1757

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

35.7%

JSON

Related for UB:CVE-2009-1757