Transmission CVE-2018-5702 Remote Command Execution Vulnerability

Bugtraq ID:	103026
Class:	Unknown
CVE:	CVE-2018-5702
Remote:	Yes
Local:	No
Published:	Nov 30 2017 12:00AM
Updated:	Nov 30 2017 12:00AM
Credit:	Tavis Ormandy
Vulnerable:	Transmission Project Transmission 1.9.2 Transmission Project Transmission 1.9.1 Transmission Project Transmission 2.92 Transmission Project Transmission 2.84 Transmission Project Transmission 2.83 Transmission Project Transmission 2.61 Transmission Project Transmission 2.60 Transmission Project Transmission 2.52 Transmission Project Transmission 2.51 Transmission Project Transmission 2.50 Transmission Project Transmission 2.42 Transmission Project Transmission 1.92 Transmission Project Transmission 1.91 Transmission Project Transmission 1.77 Transmission Project Transmission 1.76 Transmission Project Transmission 1.50 Transmission Project Transmission 1.41
Not Vulnerable:

Transmission CVE-2018-5702 Remote Command Execution Vulnerability

Transmission is prone to a remote command-execution vulnerability.

An attacker can exploit this issue to execute arbitrary commands within the context of the affected application. Failed exploits might result in denial-of-service conditions.

Transmission 2.92 and prior versions are vulnerable.

Transmission CVE-2018-5702 Remote Command Execution Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

Transmission CVE-2018-5702 Remote Command Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Transmission CVE-2018-5702 Remote Command Execution Vulnerability

References:

• CVE-2018-5702: Mitigate dns rebinding attacks against daemon (Transmission)
  
• Transmission Homepage (Transmission Project )
  
• transmission: rpc session-id mechanism design flaw (Taviso)