I see it as a very easy way to send a whole lot of files between production houses and post-prod houses, and it has no limit. The computer where the files originate must be on because its a peer-to-peer, but who cares. It's not a cloud service, so you don't have to upload then download, and its not a remote desktop kinda thing, you just specify a folder on your computer and then if you send the link and password to someone, they can download the files. Numerous products are affected by the vulnerability in the BitTorrent Sync, including solutions from DELL, HP, IBM, Novell, IBM, Oracle, Rockwell Automation, Samsung, Schneider Electric and HP.I just found out there's an app called Bittorrent Sync that makes sharing files very easy. It is important to highlight that issue was identified in November 2014 and that security experts at BitTorrent addressed and fixed the issue within the week. I reached one of the members of the team that fixed the flaw that confirmed me that security remains the top priority for the company. An attacker can leverage this vulnerability to execute code under the context of the current user.” reported an advisory published by ZDI.īitTorrent has already issued a fix for the vulnerability in the BitTorrent Sync as reported at the following URL
By navigating the user to a specially formed link starting with btsync :, an attacker can inject arbitrary command line parameters that will be passed to BTSync.exe. The vulnerability relates to how BitTorrent Sync handles URLs with the btsync protocol. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. “This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BitTorrent Sync.
In August 2014, BitTorrent reported that BitTorrent Sync had more than 10 million installations, in November of the same year Andrea Micalizzi reported the flaw to BitTorrent through the HP’s Zero Day Initiative (ZDI).
firm, it allows users to sync files between local or remote devices using on P2P protocol. BitTorrent Sync is a proprietary peer-to-peer file synchronization application developed by BitTorrent, Inc. The severity of the vulnerability has been rated as “high, in order to exploit the flaw the attacker have to trick the victim into visiting a malicious page or opening a specially crafted file. The security expert Andrea Micalizzi, also known as “rgod,”, has discovered a serious vulnerability in BitTorrent Sync ( CVE-2015-2846) can be exploited by a remote attacker to execute arbitrary code. A security expert has discovered a severe vulnerability in BitTorrent Sync that can be exploited by a remote attacker to execute arbitrary code on a vulnerable machine.
0 kommentar(er)
