CVE-2012-5965

HIGH
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long DeviceType (aka urn device) field in a UDP packet.

References

http://pupnp.sourceforge.net/ChangeLog

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp

http://www.debian.org/security/2013/dsa-2614

http://www.debian.org/security/2013/dsa-2615

http://www.kb.cert.org/vuls/id/922681

http://www.mandriva.com/security/advisories?name=MDVSA-2013:098

http://www.securityfocus.com/bid/57602

https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play

https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf

https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0037

Details

Source: MITRE

Published: 2013-01-31

Updated: 2015-09-01

Type: CWE-119

Risk Information

CVSS v2

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

Tenable Plugins

View all (11 total)

IDNameProductFamilySeverity
75214openSUSE Security Update : libupnp (openSUSE-SU-2013:0255-1)NessusSuSE Local Security Checks
critical
66110Mandriva Linux Security Advisory : libupnp (MDVSA-2013:098)NessusMandriva Local Security Checks
critical
64736Fedora 18 : mediatomb-0.12.1-23.fc18 (2013-2377)NessusFedora Local Security Checks
critical
64735Fedora 17 : mediatomb-0.12.1-23.fc17 (2013-2352)NessusFedora Local Security Checks
critical
64601Fedora 18 : libupnp-1.6.18-1.fc18 (2013-1765)NessusFedora Local Security Checks
critical
64600Fedora 17 : libupnp-1.6.18-1.fc17 (2013-1734)NessusFedora Local Security Checks
critical
64597Fedora 16 : libupnp-1.6.18-1.fc16 (2013-1713)NessusFedora Local Security Checks
critical
64396Debian DSA-2615-1 : libupnp4 - several vulnerabilitiesNessusDebian Local Security Checks
critical
64395Debian DSA-2614-1 : libupnp - several vulnerabilitiesNessusDebian Local Security Checks
critical
64394Portable SDK for UPnP Devices (libupnp) < 1.6.18 Multiple Stack-based Buffer Overflows RCENessusGain a shell remotely
critical
64374FreeBSD : upnp -- multiple vulnerabilities (2ea6ce3d-6afd-11e2-9d4e-bcaec524bf84)NessusFreeBSD Local Security Checks
critical