CVE-2012-6129: Buffer Overflow
A stack-based buffer overflow flaw was found in the way Transmission, a free, lightweight BitTorrent client, performed connection acknowledgements processing. A remote attacker could issue a specially-crafted request that, when processed would lead to transmission-daemon crash.
Upstream ticket: [1] https://trac.transmissionbt.com/ticket/5002
Source of the problem: [2] https://trac.transmissionbt.com/ticket/5002#comment:22
Libutp patches: [3] https://github.com/bittorrent/libutp/issues/38 [4] https://github.com/bittorrent/libutp/issues/37
Relevant transmission upstream patch: [5] https://trac.transmissionbt.com/changeset/13646
Other references: [6] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700234 [7] http://www.openwall.com/lists/oss-security/2013/02/10/2
Other sources
Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets."
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6129?
CVE-2012-6129 is classified as a high-severity vulnerability due to its potential to cause a denial of service by crashing the transmission-daemon.
How do I fix CVE-2012-6129?
To fix CVE-2012-6129, update Transmission to version 2.74 or later.
Which versions of Transmission are affected by CVE-2012-6129?
CVE-2012-6129 affects Transmission versions up to and including 2.73 and all versions before 2.74.
What type of vulnerability is CVE-2012-6129?
CVE-2012-6129 is a stack-based buffer overflow vulnerability.
Can CVE-2012-6129 be exploited remotely?
Yes, CVE-2012-6129 can be exploited remotely by sending specially-crafted requests to the affected Transmission services.