A vulnerability has been identified in Enhanced CTorrent (dtorrent), which could be exploited by remote attackers to cause a denial of service or compromise a vulnerable system. This issue is caused by a buffer overflow error in the "btFiles::BuildFromMI()" [btfiles.cpp] function when processing a specially crafted torrent file, which could allow attackers to crash an affected application or execute arbitrary code by tricking a user into opening a malicious file.

Affected Products

Enhanced CTorrent (dtorrent) version 3.3.2 and prior

Solution

VUPEN Security is not aware of any vendor-supplied patch.

References

http://www.vupen.com/english/advisories/2009/1092

Public Exploit or PoC

Available in customer area as part of VUPEN Vulnerability Notification Service.
 

Credits

Vulnerability reported by Michael Brooks.

Changelog

2009-04-20 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.