CVE-2016-10519: Infoleak

Q: Which deployments are exposed to this issue?

Deployments using bittorrent-dht versions before 5.1.3 are affected when they operate as a listening peer. The listed software includes WebTorrent and Node.js environments using the vulnerable bittorrent-dht package.

Q: What does an attacker need to exploit it?

An attacker can exploit the issue remotely without privileges or user interaction by sending a specific sequence of messages to a listening peer.

Q: What is disclosed if exploitation succeeds?

Successful exploitation can cause the affected peer to reveal internal memory, creating a high confidentiality impact. The provided CVSS vector indicates no integrity or availability impact.

Q: What remediation is identified by the affected-version information?

Use bittorrent-dht version 5.1.3 or later. Versions before 5.1.3 are identified as vulnerable.

Published May 31, 2018

Updated

A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.

Affected Software

1 affected component

WebTorrent Bittorrent-dht Node.js<5.1.3

Event History

May 31, 2018

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using bittorrent-dht versions before 5.1.3 are affected when they operate as a listening peer. The listed software includes WebTorrent and Node.js environments using the vulnerable bittorrent-dht package.

What does an attacker need to exploit it?

An attacker can exploit the issue remotely without privileges or user interaction by sending a specific sequence of messages to a listening peer.

What is disclosed if exploitation succeeds?

Successful exploitation can cause the affected peer to reveal internal memory, creating a high confidentiality impact. The provided CVSS vector indicates no integrity or availability impact.

What remediation is identified by the affected-version information?

Use bittorrent-dht version 5.1.3 or later. Versions before 5.1.3 are identified as vulnerable.

CVE-2016-10519: Infoleak

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is disclosed if exploitation succeeds?

What remediation is identified by the affected-version information?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is disclosed if exploitation succeeds?

What remediation is identified by the affected-version information?