Bug 1534061 (CVE-2018-5702) - CVE-2018-5702 transmission: Remote code execution (RCE) in rpc session-id via dns rebinding attack
Summary: CVE-2018-5702 transmission: Remote code execution (RCE) in rpc session-id via...
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2018-5702
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1534062 1534063
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-01-12 23:21 UTC by Laura Pardo
Modified: 2019-09-29 14:29 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 03:37:02 UTC


Attachments (Terms of Use)

Description Laura Pardo 2018-01-12 23:21:23 UTC
A flaw was found on Transmission client/server architecture. Clients interact with the daemon using JSON RPC requests to a web server listening on port 9091. The daemon will only accept requests from localhost by default, but it's common to configure NAS devices to accept remote clients.
Transmission uses a client/server architecture, the user interface is the client and a daemon runs in the background managing the downloading, seeding, etc.

As with all HTTP RPC schemes like this, any website can send requests to the daemon listening on localhost with XMLHttpRequest(), but the theory is they will be ignored because clients must prove they can read and set a specific header, X-Transmission-Session-Id.

Unfortunately, this design doesn't work because of an attack called "DNS rebinding". Any website can simply create a dns name that they are authorized to communicate with, and then make it resolve to localhost.

References:
https://github.com/transmission/transmission/pull/468
https://bugs.chromium.org/p/project-zero/issues/detail?id=1447

Comment 1 Laura Pardo 2018-01-12 23:22:12 UTC
Created transmission tracking bugs for this issue:

Affects: epel-all [bug 1534063]
Affects: fedora-all [bug 1534062]

Comment 2 Bam Bame 2019-04-07 06:23:34 UTC
hi there

Please Update Transmission on RHEL7 because there were some connectivity and stability issues that are solved on version 2.94 (May 1, 2018; 10 months ago), but there is no Update available yet!
so Please update this to 2.94 on RHEL7

regards

Comment 3 Tomas Hoger 2019-04-11 11:18:11 UTC
Instead of commenting on unrelated bugs, you should open a separate bug for your request against the right product and component:

https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=transmission&version=epel7

(The above is the guess that you're using packages form EPEL7, as transmission is not part of Red Hat Enterprise Linux.)

Comment 4 Product Security DevOps Team 2019-06-08 03:37:02 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.


Note You need to log in before you can comment on or make changes to this bug.