uTorrent and BitTorrent HTTP 'Range' Header Remote Denial of Service Vulnerability

Bugtraq ID:	29661
Class:	Design Error
CVE:	CVE-2008-0071
Remote:	Yes
Local:	No
Published:	Jun 11 2008 12:00AM
Updated:	Jun 24 2008 12:21AM
Credit:	Dyon Balding of Secunia Research
Vulnerable:	uTorrent uTorrent 1.7.7 BitTorrent BitTorrent 6.0.1
Not Vulnerable:	uTorrent uTorrent 1.8 beta build 10524 BitTorrent BitTorrent 6.0.3

uTorrent and BitTorrent HTTP 'Range' Header Remote Denial of Service Vulnerability

The WebUI for uTorrent and BitTorrent is prone to a remote denial-of-service vulnerability.

Successful exploits will crash the application, denying service to legitimate users.

uTorrent 1.7.7 and BitTorrent 6.0.1 are vulnerable; other versions may also be affected.

uTorrent and BitTorrent HTTP 'Range' Header Remote Denial of Service Vulnerability

To exploit this issue, attackers can use readily available network utilities.

The following exploit is available:

• /data/vulnerabilities/exploits/29661.pl

uTorrent and BitTorrent HTTP 'Range' Header Remote Denial of Service Vulnerability

Solution:
Fixes are available. Please see the references for more information.


BitTorrent BitTorrent 6.0.1

• BitTorrent BitTorrent 6.0.3
  http://www.bittorrent.com/download/

uTorrent and BitTorrent HTTP 'Range' Header Remote Denial of Service Vulnerability

References:

• µTorrent 1.8 beta Forum Page (uTorrent)
  
• BitTorrent Homepage (BitTorrent)
  
• uTorrent Homepage (uTorrent )
  
• Secunia Research: uTorrent / BitTorrent Web UI HTTP "Range" Header DoS (Secunia Research )