Vulnerability Name:

CVE-2010-0012 (CCN-55454)

Assigned:2009-12-26
Published:2009-12-26
Updated:2017-08-17
Summary:Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file.
CVSS v3 Severity:6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
4.3 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-22
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2010-0012

Source: SUSE
Type: UNKNOWN
SUSE-SA:2010:008

Source: SECUNIA
Type: UNKNOWN
37993

Source: CCN
Type: SA38005
Transmission "name" Key Directory Traversal Vulnerability

Source: SECUNIA
Type: UNKNOWN
38005

Source: CONFIRM
Type: UNKNOWN
http://security.debian.org/pool/updates/main/t/transmission/transmission_1.22-1+lenny2.diff.gz

Source: CONFIRM
Type: UNKNOWN
http://trac.transmissionbt.com/changeset/9829/

Source: CONFIRM
Type: UNKNOWN
http://trac.transmissionbt.com/wiki/Changes#version-1.77

Source: DEBIAN
Type: UNKNOWN
DSA-1967

Source: DEBIAN
Type: DSA-1967
transmission -- directory traversal

Source: MLIST
Type: UNKNOWN
[debian-devel-changes] 20100105 Accepted transmission 1.77-1 (source all amd64)

Source: MLIST
Type: UNKNOWN
[oss-security] 20100106 CVE Request: Transmission

Source: MLIST
Type: UNKNOWN
[oss-security] 20100106 Re: CVE Request: Transmission

Source: CCN
Type: OSVDB ID: 61601
Transmission libtransmission/metainfo.c Torrent File Traversal Arbitrary File Overwrite

Source: CCN
Type: BID-37659
Transmission Arbitrary File Overwrite Vulnerability

Source: CCN
Type: Transmission Web site
Transmission

Source: CCN
Type: USN-885-1
Transmission vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2010-0071

Source: CCN
Type: Ubuntu Bug #500625
Local file overwriting due to directory traversal

Source: XF
Type: UNKNOWN
transmission-name-directory-traversal(55454)

Source: XF
Type: UNKNOWN
transmission-name-directory-traversal(55454)

Source: CONFIRM
Type: UNKNOWN
https://launchpad.net/bugs/500625

Source: SUSE
Type: SUSE-SA:2010:008
Acrobat Reader security problems

Vulnerable Configuration:Configuration 1:
  • cpe:/a:transmissionbt:transmission:1.22:*:*:*:*:*:*:*
  • OR cpe:/a:transmissionbt:transmission:1.34:*:*:*:*:*:*:*
  • OR cpe:/a:transmissionbt:transmission:1.75:*:*:*:*:*:*:*
  • OR cpe:/a:transmissionbt:transmission:1.76:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:transmissionbt:transmission:1.41:*:*:*:*:*:*:*
  • OR cpe:/a:transmissionbt:transmission:1.50:*:*:*:*:*:*:*
  • OR cpe:/a:transmissionbt:transmission:1.76:*:*:*:*:*:*:*
  • AND
  • cpe:/o:canonical:ubuntu:8.04::lts:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:5.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2010:*:*:*:x86_64:*:*:*
  • OR cpe:/o:mandriva:linux:2010:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20100012
    V
    		CVE-2010-0012
    2015-11-16
    oval:org.mitre.oval:def:13222
    P
    		USN-885-1 -- libthai vulnerability
    2014-06-30
    oval:org.mitre.oval:def:7068
    P
    		DSA-1967 transmission -- directory traversal
    2014-06-23
    oval:org.mitre.oval:def:13619
    P
    		DSA-1967-1 transmission -- directory traversal
    2014-06-23
    oval:org.debian:def:1967
    V
    		directory traversal
    2010-01-07
    BACK
    transmissionbt transmission 1.22
    transmissionbt transmission 1.34
    transmissionbt transmission 1.75
    transmissionbt transmission 1.76
    transmissionbt transmission 1.41
    transmissionbt transmission 1.50
    transmissionbt transmission 1.76
    canonical ubuntu 8.04
    novell opensuse 11.0
    debian debian linux 5.0
    mandriva linux 2010
    mandriva linux 2010