If you are running Windows [...]
and
from June 2015 until the present, affecting v3.2.1 through v5.0.0 inclusive. The behaviour does not appear to be replicated for other OS variants
this post was submitted on 31 Oct 2024
74 points (100.0% liked)
Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ
69405 readers
179 users here now
⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.
Rules • Full Version
1. Posts must be related to the discussion of digital piracy
2. Don't request invites, trade, sell, or self-promote
3. Don't request or link to specific pirated titles, including DMs
4. Don't submit low-quality posts, be entitled, or harass others
Loot, Pillage, & Plunder
We heartily recommend visiting the free port of freemediaheckyeah (aka FMHY) while you sail the high seas, for all the freshest links the ocean has to offer.
📜 c/Piracy Wiki (Community Edition):
🏴☠️ Other communities
FUCK ADOBE!
Torrenting/P2P:
- !seedboxes@lemmy.dbzer0.com
- !trackers@lemmy.dbzer0.com
- !qbittorrent@lemmy.dbzer0.com
- !libretorrent@lemmy.dbzer0.com
- !soulseek@lemmy.dbzer0.com
Gaming:
- !steamdeckpirates@lemmy.dbzer0.com
- !newyuzupiracy@lemmy.dbzer0.com
- !switchpirates@lemmy.dbzer0.com
- !3dspiracy@lemmy.dbzer0.com
- !retropirates@lemmy.dbzer0.com
💰 Please help cover server costs.
 |
 |
|---|---|
| Ko-fi | Liberapay |
founded 3 years ago
MODERATORS
Notably, 5.0.1 was released three days ago. So a fix is available.
The first patched release is version 5.0.1, released 2 days ago.
Containerization helps, but best to patch asap.
Perfect example of a (part of a) security vulnerability being fixed in a commit that doesn't immediately seem security related and would never be back ported to a ~~stable~~stale distro
The code which parses the binary MaxMind database after decompression is well guarded as of 2024 but used to look different, potentially providing more attack surface. There is also an interesting commit where a contributor makes adjustments to the
gzip::decompress()function which hints at a stack overflow, as the destination buffer was changed from static allocation on the stack to dynamic allocation on the heap, though it was not exploitable due to checks before it is written to
Mitigations
Just use another torrent client. Deluge and Transmission etc do not have this vulnerability.
Was wondering what the takeaway is here. I updated to 5.0.1. Does that fix all these? If not, guess I'll try a different torrent client.
The first patched release is version 5.0.1, released 2 days ago.
yeah, they have other undiscovered vulnerabilities
Is there something we should do in the meantime? I’m not the most savvy individual when it comes to tech on this level.
Not really. This requires a sophisticated attacker. I’d suggest updating soon but I doubt most people are at risk. As always verify downloads before running them and check where you should be getting updates and if you’re sent to a sketchy file host try to find updates from the official website instead.
The biggest risk is MTM interception and replacement of the python executable if you try and use the search tool for the first time. I suppose avoid doing that until you update the client from their website.
Thanks. This makes it a lot clearer.
Just update it to the latest
Ah. So this has already been addressed? Okay, thanks for responding.
Yea that was very unclear to me that it was already addressed.
Will I be OK updating from the Debian repo?
From another poster above, it seems only Windows machines are affected.
i kinda wish that some people who post security vulns stop being so vague and cherry-picky sometimes, like you could have written in your post that it only affects windows and it affects only a certain range of versions of the program. would have clearned things up better imo. interesting to know, though.