The Remote host is installed with Aria2 and is prone to directory traversal vulnerability.

Successful exploitation will allow attackers to download files to directories outside of the intended download directory via directory traversal attacks. Impact Level: Application

Upgrade to Aria2 1.9.3, For updates refer to http://sourceforge.net/projects/aria2/files/

The flaw is due to an error in the hanling of metalink files. The 'name' attribute of a 'file' element in a metalink file is not properly sanitised.

Aria2 version prior to 1.9.3

• http://osvdb.org/64592
• http://secunia.com/secunia_research/2010-71/
• http://www.securityfocus.com/archive/1/archive/1/511280/100/0/threaded

---

Updated on 2015-03-25