Test ID:	1.3.6.1.4.1.25623.1.0.801341
Category:	Web application abuses
Title:	Aria2 metalink 'name' Directory Traversal Vulnerability
Summary:	Aria2 is prone to a directory traversal vulnerability.
Description:	Summary: Aria2 is prone to a directory traversal vulnerability. Vulnerability Insight: The flaw is due to an error in the handling of metalink files. The 'name' attribute of a 'file' element in a metalink file is not properly sanitised. Vulnerability Impact: Successful exploitation will allow attackers to download files to directories outside of the intended download directory via directory traversal attacks. Affected Software/OS: Aria2 version prior to 1.9.3 Solution: Upgrade to Aria2 1.9.3. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-1512 BugTraq ID: 40142 http://www.securityfocus.com/bid/40142 Bugtraq: 20100513 Secunia Research: aria2 metalink "name" Directory Traversal Vulnerability (Google Search) http://www.securityfocus.com/archive/1/511280/100/0/threaded Debian Security Information: DSA-2047 (Google Search) http://www.debian.org/security/2010/dsa-2047 http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041753.html http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041754.html http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041758.html http://security.gentoo.org/glsa/glsa-201101-04.xml http://www.mandriva.com/security/advisories?name=MDVSA-2010:106 http://secunia.com/secunia_research/2010-71/ http://www.osvdb.org/64592 http://secunia.com/advisories/39529 http://secunia.com/advisories/39872 http://secunia.com/advisories/42906 SuSE Security Announcement: SUSE-SR:2010:014 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html SuSE Security Announcement: SUSE-SR:2010:017 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://www.vupen.com/english/advisories/2010/1228 http://www.vupen.com/english/advisories/2010/1229 http://www.vupen.com/english/advisories/2011/0116
Copyright	Copyright (C) 2010 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.