uTorrent Multiple DLL Loading Arbitrary Code Execution Vulnerability

Bugtraq ID:	42632
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 24 2010 12:00AM
Updated:	Sep 01 2010 06:36PM
Credit:	TheLeader, Dr_IDE
Vulnerable:	uTorrent uTorrent 2.0.3 uTorrent uTorrent 1.7.7 uTorrent uTorrent 1.7.6 uTorrent uTorrent 1.7.5 uTorrent uTorrent 1.6.1 uTorrent uTorrent 1.8.3 (build 15772) uTorrent uTorrent 1.8 beta build 10524 uTorrent uTorrent 1.7.7 (build 8179) uTorrent uTorrent 1.6
Not Vulnerable:	uTorrent uTorrent 2.0.4

uTorrent Multiple DLL Loading Arbitrary Code Execution Vulnerability

uTorrent is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user into using the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Linked Library (DLL) file.

uTorrent 2.0.3 is vulnerable; other versions may also be affected.

uTorrent Multiple DLL Loading Arbitrary Code Execution Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/42632.c

uTorrent Multiple DLL Loading Arbitrary Code Execution Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

uTorrent Multiple DLL Loading Arbitrary Code Execution Vulnerability

References:

• µTorrent 2.0.4 released (uTorrent)
  
• uTorrent DLL Hijacking Vulnerabilities (Dr_IDE)
  
• uTorrent Homepage (uTorrent )
  
• Microsoft Security Advisory (2269637) (Microsoft)