CVE-2010-0012 in transmission
Summary
by MITRE
Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/02/2025
The vulnerability identified as CVE-2010-0012 represents a critical directory traversal flaw within the Transmission BitTorrent client software. This security weakness exists in the metainfo.c component of Transmission versions 1.22, 1.34, 1.75, and 1.76, where the software fails to properly validate pathname sequences within .torrent files. The vulnerability specifically allows remote attackers to exploit a .. (dot dot) sequence in file paths, enabling them to manipulate the file system by overwriting arbitrary files on the target system. This flaw fundamentally compromises the integrity of the software's file handling mechanisms and presents a significant risk to users who download and process torrent files from untrusted sources.
The technical implementation of this vulnerability stems from insufficient input validation within the torrent file parsing logic. When Transmission processes a .torrent file containing a pathname with directory traversal sequences, the software does not adequately sanitize these paths before attempting to create or modify files on the local file system. This allows attackers to craft malicious torrent files that contain paths such as ../../etc/passwd or ../../../windows/system32/config/sam, which when processed by the vulnerable Transmission client can result in arbitrary file overwrites or creation. The vulnerability is classified as a directory traversal attack pattern that aligns with CWE-22, which specifically addresses improper limitation of a pathname to a restricted directory. This weakness creates a direct path for attackers to bypass normal file system access controls and potentially execute malicious operations.
The operational impact of this vulnerability extends beyond simple file overwrites to encompass potential system compromise and data integrity breaches. An attacker who successfully exploits this vulnerability can overwrite critical system files, configuration files, or user data, potentially leading to system instability, unauthorized access, or complete system compromise. The vulnerability is particularly dangerous because it can be exploited remotely through the distribution of malicious torrent files, making it an attractive vector for attackers seeking to compromise systems without requiring direct access. This type of attack aligns with ATT&CK technique T1059.007, which covers the use of command and scripting interpreter for execution, as the exploitation can lead to arbitrary code execution through file system manipulation. The vulnerability affects both the availability and integrity of the affected systems, as legitimate files can be overwritten or corrupted, potentially rendering the system unstable or unusable.
Mitigation strategies for this vulnerability must address both immediate remediation and long-term security enhancements. The primary and most effective mitigation is to upgrade to Transmission versions that have patched this vulnerability, specifically versions beyond 1.76. Organizations should implement comprehensive patch management procedures to ensure all Transmission installations are updated promptly. Additionally, network administrators should consider implementing restrictions on torrent file downloads from untrusted sources and establish security policies that limit the execution of torrent clients in restricted environments. The vulnerability demonstrates the importance of proper input validation and secure coding practices, particularly in software that processes user-supplied data. Security measures should include monitoring for suspicious file creation patterns and implementing file system access controls that limit the impact of potential exploitation attempts. Organizations should also consider network segmentation and intrusion detection systems to identify and prevent exploitation attempts targeting this specific vulnerability pattern.