FKIE_CVE-2008-0646

Vulnerability from fkie_nvd - Published: 2008-02-07 21:00 - Updated: 2026-06-16 22:50
Severity
Summary
The bdecode_recursive function in include/libtorrent/bencode.hpp in Rasterbar Software libtorrent before 0.12.1, as used in Deluge before 0.5.8.3 and other products, allows context-dependent attackers to cause a denial of service (stack exhaustion and crash) via a crafted bencoded message.
References
cve@mitre.orghttp://deluge-torrent.org/Changelog.php
cve@mitre.orghttp://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_12/include/libtorrent/bencode.hpp?r1=956&r2=1968&pathrev=1968Exploit
cve@mitre.orghttp://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_12/include/libtorrent/bencode.hpp?view=log&pathrev=1968#rev1968
cve@mitre.orghttp://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_13/include/libtorrent/bencode.hpp?view=log&pathrev=1968
cve@mitre.orghttp://libtorrent.svn.sourceforge.net/viewvc/libtorrent/trunk/include/libtorrent/bencode.hpp?view=log&pathrev=1968
cve@mitre.orghttp://secunia.com/advisories/28699Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/28700
cve@mitre.orghttp://secunia.com/advisories/28781Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/28782
cve@mitre.orghttp://www.securityfocus.com/bid/27597Patch
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/0383
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/0384
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00001.html
af854a3a-2127-422b-91ae-364da2661108http://deluge-torrent.org/Changelog.php
af854a3a-2127-422b-91ae-364da2661108http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_12/include/libtorrent/bencode.hpp?r1=956&r2=1968&pathrev=1968Exploit
af854a3a-2127-422b-91ae-364da2661108http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_12/include/libtorrent/bencode.hpp?view=log&pathrev=1968#rev1968
af854a3a-2127-422b-91ae-364da2661108http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_13/include/libtorrent/bencode.hpp?view=log&pathrev=1968
af854a3a-2127-422b-91ae-364da2661108http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/trunk/include/libtorrent/bencode.hpp?view=log&pathrev=1968
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/28699Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/28700
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/28781Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/28782
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/27597Patch
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/0383
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/0384
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00001.html
Impacted products
Vendor Product Version
deluge_team deluge *
rasterbar_software libtorrent *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:deluge_team:deluge:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F203334A-55B8-44EA-9AA4-B58A264A0F8A",
              "versionEndIncluding": "0.5.8.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rasterbar_software:libtorrent:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF27B258-6566-4E94-B81E-D40575FDA915",
              "versionEndIncluding": "0.12",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The bdecode_recursive function in include/libtorrent/bencode.hpp in Rasterbar Software libtorrent before 0.12.1, as used in Deluge before 0.5.8.3 and other products, allows context-dependent attackers to cause a denial of service (stack exhaustion and crash) via a crafted bencoded message."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n recursiva bdecode en include/libtorrent/bencode.hpp en Rasterbar Software libtorrent versiones anteriores a 0.12.1, usado en Deluge versiones anteriores a 0.5.8.3 y en otros productos, permite a atacantes seg\u00fan contexto provocar una denegaci\u00f3n de servicio (agotamiento de pila y ca\u00edda) a trav\u00e9s de un mensaje bencoded manipulado."
    }
  ],
  "id": "CVE-2008-0646",
  "lastModified": "2026-06-16T22:50:03.253",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.8,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-02-07T21:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://deluge-torrent.org/Changelog.php"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_12/include/libtorrent/bencode.hpp?r1=956\u0026r2=1968\u0026pathrev=1968"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_12/include/libtorrent/bencode.hpp?view=log\u0026pathrev=1968#rev1968"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_13/include/libtorrent/bencode.hpp?view=log\u0026pathrev=1968"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/trunk/include/libtorrent/bencode.hpp?view=log\u0026pathrev=1968"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/28699"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/28700"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/28781"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/28782"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/27597"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/0383"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/0384"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://deluge-torrent.org/Changelog.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_12/include/libtorrent/bencode.hpp?r1=956\u0026r2=1968\u0026pathrev=1968"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_12/include/libtorrent/bencode.hpp?view=log\u0026pathrev=1968#rev1968"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/branches/RC_0_13/include/libtorrent/bencode.hpp?view=log\u0026pathrev=1968"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://libtorrent.svn.sourceforge.net/viewvc/libtorrent/trunk/include/libtorrent/bencode.hpp?view=log\u0026pathrev=1968"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/28699"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/28700"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/28781"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/28782"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/27597"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/0383"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/0384"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00001.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.