[Security] UPNP opens port 0 which fully exposes PC to the internet.

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

Nice debugging; thanks for the patch. Do you know if a CVE has been assigned yet?

Thanks

Sorry no CVE has been filed as we don't know the procedure.
As for posing a debdiff do you have a guide on how to do this from Fedora?

So this looks like upstream commit 10001 and 10003:

https://code.google.com/p/libtorrent/source/detail?r=10001
https://code.google.com/p/libtorrent/source/detail?r=10003

Which were released in libtorrent-rasterbar-0.16.17.tar.gz

I'll get this into Debian sid and Ubuntu utopic shortly, and then kick off the SRU process for trusty.

This bug was fixed in the package libtorrent-rasterbar - 0.16.17-1ubuntu2

---------------
libtorrent-rasterbar (0.16.17-1ubuntu2) utopic; urgency=medium

  * Make sure repatch target is actually called.
  * Build against Boost 1.55.

libtorrent-rasterbar (0.16.17-1ubuntu1) utopic; urgency=medium

  * Reapply ppc64el delta.
   - Use dh-autoreconf for ppc64el.
   - Add repatch target to debian/rules to work around autoreconf
     regenerating the patched configure script.

libtorrent-rasterbar (0.16.17-1) unstable; urgency=medium

  * New upstream release.
   - Don't fall back on wildcard port in UPnP (LP: #1330703).
 -- Andrew Starr-Bochicchio <email address hidden> Sun, 22 Jun 2014 13:05:14 -0400

When this fixed in 14.04 Trusty Tahr for 14.04.1 (24 July)?

Many "critical" bugs on ReleaseNotes Trusty Tahr page don't fixed presently: https://wiki.ubuntu.com/TrustyTahr/ReleaseNotes#Known_issues
Installation bugs too:
https://bugs.launchpad.net/ubuntu/+source/ubiquity/+bug/1066480
https://bugs.launchpad.net/ubuntu/+source/ubiquity/+bug/1172572
https://bugs.launchpad.net/ubuntu/+source/graphite2/+bug/1303516
https://bugs.launchpad.net/ubuntu/+source/ubiquity/+bug/1297851
https://bugs.launchpad.net/ubuntu/+source/ubiquity/+bug/1066342
https://bugs.launchpad.net/ubuntu/+source/ubiquity/+bug/1172161
https://bugs.launchpad.net/ubuntu/+source/console-setup/+bug/1297234

upgrade:
https://bugs.launchpad.net/ubuntu/+source/ubiquity/+bug/1308530
https://bugs.launchpad.net/ubuntu/+source/tex-common/+bug/1304972
https://bugs.launchpad.net/ubuntu/+source/flightgear/+bug/1308338

and other:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1054732
https://bugs.launchpad.net/unity/+bug/1305586
https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1271591
https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308037
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1305522
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1308761
https://bugs.launchpad.net/ubuntu/+source/unity-greeter/+bug/1292467

Too many errors in Trusty on: http://errors.ubuntu.com
Please fix the most annoying bugs. It interferes with work, use and distribution advice to friends.

ACK on the debdiff, thanks!

It is building now and will be released today.

This bug was fixed in the package libtorrent-rasterbar - 0.16.13-1ubuntu2.1

---------------
libtorrent-rasterbar (0.16.13-1ubuntu2.1) trusty-security; urgency=medium

  * SECURITY UPDATE: Stop UPnP from falling back on port 0. Routers
    may forward unmapped ports to the given IP, exposing the machine
    to the internet (LP: #1330703).
 -- Andrew Starr-Bochicchio <email address hidden> Mon, 23 Jun 2014 22:42:45 -0400