GazelleGames News - uTorrent removed from the client whitelist (Update)

Update:
For now we have allowed uTorrent 1.8.x, 2.0.4, 2.1.x and 2.2.x. To be safe, it is strongly advised to set Advanced -> net.discoverable to false and restart the torrent client.

https://ptpimg.me/gmg93n.png

---

A major vulnerability has been recently been discovered in uTorrent that allows attackers to download files from computers running old versions of uTorrent. This vulnerability exploits an JSON RPC server used by the uTorrent program. Old versions of uTorrent such as version 2.2.1 are not maintained and will not be patched to fix this vulnerability.

As such, all versions of uTorrent have been removed from the client whitelist.

The only way to fix this is to use a client other than uTorrent.

Users can reduce but not eliminate this vulnerability by setting net.discoverable to false, which will disable the dedicated port for the RPC. However this vulnerability is still exploitable over the port that uTorrent uses for all incoming connections.

A detailed bug report can be found here:
https://bugs.chromium.org/p/project-...detail?id=1524

More information can be found on the PTP and AB announcements.


Item Cost 0.8 - :D