The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.

The remote host is affected by the vulnerability described in GLSA-201701-41 (MiniUPnPc: Buffer overflow)

    An out-of-bounds read was discovered in the getHTTPResponse function in       miniwget.c in MiniUPnPc.
  Impact :

    Remote attackers, through specially crafted headers, could cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2280-1 advisory.

    It was discovered that MiniUPnPc incorrectly handled certain buffer lengths. A remote attacker could     possibly use this issue to cause applications using MiniUPnPc to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

miniupnpc was updated to 1.9 to fix a potential buffer overrun in miniwget.c (CVE-2014-3985).

Besides that the following issues were fixed :

  - added argument remoteHost to     UPNP_GetSpecificPortMappingEntry()

  - increment API_VERSION to 10

  - --help and -h arguments in upnpc.c

  - define MAXHOSTNAMELEN if not already done

  - update upnpreplyparse to allow larger values (128 chars     instead of 64) 

  - Update upnpreplyparse to take into account 'empty'     elements

  - validate upnpreplyparse.c code with 'make check'

  - Fix Solaris build thanks to Maciej Ma&#x142;ecki

  - Fix testminiwget.sh for BSD

  - Fixed Makefile for *BSD

  - Update Makefile to use JNAerator version 0.11

  - Fix testminiwget.sh for use with dash

  - Use $(DESTDIR) in Makefile

Updated miniupnpc packages fix security vulnerability :

The miniupnpc library before 1.9 may be vulnerable to a denial of service due to a buffer overrun that can be triggered by something on the network.

ID	Name	Product	Family	Type	Severity
96575	GLSA-201701-41 : MiniUPnPc: Buffer overflow	Nessus	Gentoo Local Security Checks	Local	medium
76560	Ubuntu 14.04 LTS : MiniUPnPc vulnerability (USN-2280-1)	Nessus	Ubuntu Local Security Checks	Local	high
76137	openSUSE Security Update : miniupnpc (openSUSE-SU-2014:0815-1)	Nessus	SuSE Local Security Checks	Local	medium
74453	Mandriva Linux Security Advisory : miniupnpc (MDVSA-2014:120)	Nessus	Mandriva Local Security Checks	Local	high

Detections

Analytics

CVE-2014-3985

high

Tenable Plugins

medium

high

medium

high