CVE-2012-5960high
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a long UDN (aka upnp:rootdevice) field in a UDP packet.
References
http://lists.opensuse.org/opensuse-updates/2013-02/msg00013.html
http://pupnp.sourceforge.net/ChangeLog
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
http://www.debian.org/security/2013/dsa-2614
http://www.debian.org/security/2013/dsa-2615
http://www.kb.cert.org/vuls/id/922681
http://www.mandriva.com/security/advisories?name=MDVSA-2013:098
http://www.securityfocus.com/bid/57602
https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf
https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0037
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.3:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.4:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.5:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.6:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.1:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.2:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.3:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.4:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.5:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.6:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.7:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.8:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.9:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.10:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.11:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.12:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.13:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.14:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.15:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.6.16:*:*:*:*:*:*:*
cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:*:*:*:*:*:*:*:* versions up to 1.6.17 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 75214 | openSUSE Security Update : libupnp (openSUSE-SU-2013:0255-1) | Nessus | SuSE Local Security Checks | critical |
| 73219 | GLSA-201403-06 : libupnp: Arbitrary code execution | Nessus | Gentoo Local Security Checks | critical |
| 66110 | Mandriva Linux Security Advisory : libupnp (MDVSA-2013:098) | Nessus | Mandriva Local Security Checks | critical |
| 64736 | Fedora 18 : mediatomb-0.12.1-23.fc18 (2013-2377) | Nessus | Fedora Local Security Checks | critical |
| 64735 | Fedora 17 : mediatomb-0.12.1-23.fc17 (2013-2352) | Nessus | Fedora Local Security Checks | critical |
| 64601 | Fedora 18 : libupnp-1.6.18-1.fc18 (2013-1765) | Nessus | Fedora Local Security Checks | critical |
| 64600 | Fedora 17 : libupnp-1.6.18-1.fc17 (2013-1734) | Nessus | Fedora Local Security Checks | critical |
| 64597 | Fedora 16 : libupnp-1.6.18-1.fc16 (2013-1713) | Nessus | Fedora Local Security Checks | critical |
| 64396 | Debian DSA-2615-1 : libupnp4 - several vulnerabilities | Nessus | Debian Local Security Checks | critical |
| 64395 | Debian DSA-2614-1 : libupnp - several vulnerabilities | Nessus | Debian Local Security Checks | critical |
| 64394 | Portable SDK for UPnP Devices (libupnp) < 1.6.18 Multiple Stack-based Buffer Overflows RCE | Nessus | Gain a shell remotely | critical |
| 64374 | FreeBSD : upnp -- multiple vulnerabilities (2ea6ce3d-6afd-11e2-9d4e-bcaec524bf84) | Nessus | FreeBSD Local Security Checks | critical |