digg

Facebook Connect Join Digg About
See the original image at torrentfreak.com

Critical Vulnerability Discovered in uTorrent

torrentfreak.com — A vulnerability described as ‘critical’ has been discovered in versions of uTorrent and the official BitTorrent client. The ‘buffer overflow’ vulnerability can be exploited to compromise a user’s computer for the execution of arbitrary code. It is suggested that users should immediately update to uTorrent version 1.8 RC7 or higher.

Who dugg this? Made popular Aug 13, 2008

Digg DudeWhat is Digg?

Digg is a place for people to discover and share content from anywhere on the web. Digg surfaces the best stuff as submitted and voted on by the community. Take the Tour to learn more.

107 Comments

show profanity settings
expand all
  • inactive, on 08/13/2008, -10/+227What are things coming to these days when I can't even trust a program used to illegally download files.
  • allyant, on 08/13/2008, -4/+41**puts on tin foil hat on**
    They are just saying this so they can get everyone to update to there MPAA & RIAA sponsored uTorrent version 1.8 RC7+
  • doshindude, on 08/13/2008, -6/+34Well, good thing I've updated to 1.8.
  • MavRevMatt, on 08/13/2008, -2/+26Wrong.

    "Both clients are being developed by BitTorrent Inc. "
  • KineticShampoo, on 08/13/2008, -8/+25I don't know why you're being dugg down. Truth is the maker of uTorrent works for the RIAA now, and keeps this project on the side. Now people can trust him or not, but I don't.

    Your call dudes.
  • aforsberg, on 08/13/2008, -0/+16You can't hack me; I got Norton!
  • MillionsLivio, on 08/13/2008, -1/+14BitTorrent Inc has been in business with the MPAA and BitTorrent Inc also bought µTorrent.
    http://www.slyck.com/story1006_BitTorrent_and_MPAA ...
  • TripcodeMel, on 08/13/2008, -4/+16Here's how it works. BitTorrent Inc. is being funded in part by the MAFIAA. Everyone's assumed that automatically means all client versions past 1.6, when BitTorrent took over the uTorrent project, are bugged and rigged and are spying on you and support terrorism and all that jazz. No honest to goodness evidence has been given to support this, aside from tinfoil-hat douchebaggery. So use it, or don't - if you're paranoid. That's all there is to it.
  • JasonCox, on 08/13/2008, -3/+14Rut roh, raggy.
  • pe5t1lence, on 08/13/2008, -1/+11It doesn't say anything about this on utorrent's website. So I am taking this as false until more proof comes up.
  • legoalert33, on 08/13/2008, -0/+9Maybe they're just stupid comments.
  • HellifIno, on 08/13/2008, -0/+9Yeah! My ***** is TIGHT! Come get me! 127.0.0.1!
  • chromerium, on 08/13/2008, -0/+9Its a difficult protocol to code for. I'm not surprised, really.
  • SmartedPanda, on 08/13/2008, -0/+8I prefer /sarcasm, /not being serious is like....wtf? =]
  • borez, on 08/13/2008, -6/+14Does MakiMaki ever sleep... He says realising it's 4am.
  • rnawky, on 08/13/2008, -0/+8Uh it's fixed if you upgraded....
  • balr0g, on 08/13/2008, -0/+7False announce so that every users of the old µtorrent are forced to upgrade. Now µtorrent corp (which is having sex with the MAFIAA) can sniff all your piratebay downloads. See you in jail, or use Halite ( http://www.binarynotions.com/halite-bittorrent-cli ... )
  • wazzledoozle2, on 08/13/2008, -1/+7More about this sponsorship?
  • allyant, on 08/13/2008, -1/+7@jcunews - But utorrent is closed source.
  • ptFoe, on 08/13/2008, -3/+9A scam to get people to stop people from using Utorrent v1.61 which was the last version before it was bought out by an MPAA pony.
  • schnibitz, on 08/13/2008, -2/+8Run software as a regular user, or better yet, as a guest.

    Problems like this won't affect your machine.
  • rnawky, on 08/13/2008, -1/+6Doesn't "Data Execution Prevention" prevent this?
  • twiztidsinz, on 08/13/2008, -2/+7It's in the headline because it effects uTorrent.
    The current release I'm guessing is OK, but MANY people use an old verson like 1.6.7
  • KnightMareInc, on 08/13/2008, -6/+11so the offical release of 1.8 doesnt have this? Why is utorrent even in the headline?
  • fpaudon, on 08/13/2008, -8/+13How do we know this isn't some kind of stunt to force us to upgrade to 1.8?
  • Spure, on 08/13/2008, -0/+5hahahaha....WOW.
  • MavRevMatt, on 08/13/2008, -1/+6As much as I love Transmission on my laptop, running Linux, it's not on Windows, and uTorrent applies mostly to Windows users.
  • plup, on 08/13/2008, -1/+6Seedbox is cheating. Real men seed torrents with a 56k dial-up connection.
  • synystar, on 08/13/2008, -0/+4"What the ***** is the Internet?:
  • person425, on 08/13/2008, -0/+3teehee DEP is broken
    OS level protections just make it more of a pain in the ass to exploit vulnerabilities. Nothing can protect you from poorly written code (no one writes perfect code).
  • Babazoz, on 08/13/2008, -1/+4Give the man a see-gar. Halite is awesome as hell and open source, and better yet, when you fire it up, PeerGuardian doesn't flash the words "BITTORRENT, INC." across its blocked list.
  • TheGuruStud, on 08/13/2008, -0/+3No matter, they can't find people that don't have ISP accounts muhahahahahahhahaha.
  • twiztidsinz, on 08/13/2008, -0/+3uh... 1.8RC7 -has- the fix... I'd venture the guess that 1.8 official release has it taken care of.
  • Slash0, on 08/13/2008, -0/+2Might as well update *instead* of reading this if you haven't yet.
  • mrsteveman1, on 08/13/2008, -1/+3If it were true someone would have disassembled the client by now and posted all the supur sekrit spy functions somewhere for the world to see.

    It hasn't happened. They bought uTorrent because it was a good codebase for their other projects, evidence of this is the fact that this vulnerability affected both uTorrent and BitTorrents main client, because they share code now.
  • lowtolerance, on 08/13/2008, -1/+3Yes, that is why malware can never be executed on a regular user account.

    /not being serious.
  • TheGuruStud, on 08/13/2008, -1/+3Who was kissing you?
  • afx1, on 08/13/2008, -0/+2coz 1.8 is their cashcow and secunia is in on the scam
  • Meocross, on 08/13/2008, -3/+5Could be, and maybe 1.8 has a anti-piracy rootkit throttler attached to it, Bitorrent Inc and the MAFIAA are close partners you know >_>
  • taseedorf, on 08/13/2008, -1/+3To the guy who is claiming this a scam, well, give me you're IP and I'll show you it's not.

    While I do love uTorrent, there is not a client for Linux which sucks. Also,uTorrent does suck because it was bought out and something seems fishy....so I switched.
  • plup, on 08/13/2008, -0/+2No.
  • kermithefrogand, on 08/13/2008, -1/+2i'm just saying, this feels like a fox news scare tactic. I doubt this story!
  • slythfox, on 08/13/2008, -1/+2Ah?
  • ZippyV, on 08/13/2008, -0/+1The programmer has to compile his application with this protection, otherwise it won't work.
  • lowtolerance, on 08/13/2008, -0/+1I understand your point, but arbitrary code execution isn't necessarily limited to modifying system files. True, a regular user can't go around deleting system files, but system programs can run with full privileged access, even when initiated by unprivileged users. Occasionally an exploit will pop up that takes advantage of this, and it WILL allow arbitrary code execution to clobber critical files. While this is not the case with the utorrent exploit, your method of protection does not guarantee safety. Sorry for being a smartass.
  • scarwars, on 08/13/2008, -0/+1v1.6 & v1.6. are not affected by the xploit.. so yes you are right.
  • synystar, on 08/13/2008, -1/+2Not necessary. Your first comment will end up having a helluva lot more diggs than buries breakaway.
  • MrViklund, on 08/14/2008, -1/+2http://azureus.sourceforge.net/
  • Babazoz, on 08/14/2008, -0/+1Yes it does. There's a tab down there for files.
  • Meocross, on 08/13/2008, -0/+1LoL that was rich.
  • Fetching more discussions...
    Show 51 - 100 of 108 discussions

  • Add a Comment

    Login or register to comment!
    Or, sign-in super fast with your Facebook account ...

© Digg Inc. 2009 — Content created and posted by Digg users is dedicated to the public domain | Terms of Use Updated | Privacy Policy
DIGG, DIGG IT, DUGG, DIGG THIS, Digg graphics, logos, designs, page headers, button icons, scripts, and other service names are the trademarks of Digg Inc.