aria2 contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the program not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the name attribute of the metalink file. This directory traversal attack would allow the attacker to create or replace files on the file system with arbitrary content.

Upgrade to version 1.9.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2010-1512 (see also: NVD)
• Secunia Advisory ID: 39529 39759 39872 40855 41529 42906
• Bugtraq ID: 40142
• Vendor URL: http://aria2.sourceforge.net/
• Generic Exploit URL: http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/test/metalink4-dosdirtraversal.xml?view=markup&pathrev=2097
• Generic Informational URL: http://aria2.svn.sourceforge.net/viewvc/aria2?view=rev&revision=2097
• Vendor Specific News/Changelog Entry: http://downloads.sourceforge.net/project/aria2/stable/aria2-1.9.3/NEWS
  http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
  http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
• Vendor Specific Advisory URL: http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041754.html
  http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041758.html
  http://www.gentoo.org/security/en/glsa/glsa-201101-04.xml
  http://www.us.debian.org/security/2010/dsa-2047
• Mail List Post: http://seclists.org/bugtraq/2010/May/115
• Other Advisory URL: http://secunia.com/secunia_research/2010-71/

• Stefan Cornelius - Secunia Research