Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4794-1 advisory.

    Matthew Garrett discovered that libupnp mishandled POST requests by default. An attacker could use this     vulnerability to write files to arbitrary locations in the victim's filesystem, possibly as root.
    (CVE-2016-6255)

    It was discovered that libupnp mishandled certain input. A remote attacker could use this vulnerability to     cause a denial of service (crash) or possibly execute arbitrary code. (CVE-2016-8863)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- miniserver: fix binding to ipv6 link-local addresses

  - Fix out-of-bound access in create_url_list()     (CVE-2016-8863)

  - If the error or info log files can not be created, use     stderr and stdout instead.

  - SF Bug Tracker #132 CVE-2016-6255: write files via POST

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to libupnp 1.6.21 fixes the following security issues :

  - various string handling issues (bsc#898167)

  - CVE-2016-8863: out-of-bounds access (bsc#1006256)

  - CVE-2016-6255: fix for file write via POST (bsc#989948)

The remote host is affected by the vulnerability described in GLSA-201701-52 (libupnp: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libupnp. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attack could arbitrarily write files to a users file system,       cause a Denial of Service condition, or execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

Matthew Garett reports :

Reported this to upstream 8 months ago without response, so: libupnp's default behaviour allows anyone to write to your filesystem.
Seriously. Find a device running a libupnp based server (Shodan says there's rather a lot), and POST a file to /testfile. Then GET /testfile ... and yeah if the server is running as root (it is) and is using / as the web root (probably not, but maybe) this gives full host fs access.

Scott Tenaglia reports :

There is a heap buffer overflow vulnerability in the create_url_list function in upnp/src/gena/gena_device.c.

Two vulnerabilities were discovered in libupnp, a portable SDK for UPnP devices.

  - CVE-2016-6255     Matthew Garret discovered that libupnp by default allows     any user to write to the filesystem of the host running     a libupnp-based server application.

  - CVE-2016-8863     Scott Tenaglia discovered a heap buffer overflow     vulnerability, that can lead to denial of service or     remote code execution.

Scott Tenaglia discovered a heap-based buffer overflow in libupnp4, a portable SDK for UPnP Devices. That can lead to denial of service or remote code execution.

For Debian 7 'Wheezy', these problems have been fixed in version 1.8.0~svn20100507-1.2+deb7u1.

We recommend that you upgrade your libupnp4 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Scott Tenaglia discovered a heap-based buffer overflow in libupnp, a portable SDK for UPnP Devices. That can lead to denial of service or remote code execution.

For Debian 7 'Wheezy', these problems have been fixed in version 1:1.6.17-1.2+deb7u2.

We recommend that you upgrade your libupnp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
183693	Ubuntu 16.04 ESM : libupnp vulnerabilities (USN-4794-1)	Nessus	Ubuntu Local Security Checks	Local	critical
101590	Fedora 26 : libupnp (2017-23535a31f8)	Nessus	Fedora Local Security Checks	Local	critical
100612	openSUSE Security Update : libupnp (openSUSE-2017-650)	Nessus	SuSE Local Security Checks	Local	critical
97702	Fedora 24 : libupnp (2017-3bd0b2e2c0)	Nessus	Fedora Local Security Checks	Local	critical
97674	Fedora 25 : libupnp (2017-2c29702300)	Nessus	Fedora Local Security Checks	Local	critical
96687	GLSA-201701-52 : libupnp: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
96163	FreeBSD : upnp -- multiple vulnerabilities (244c8288-cc4a-11e6-a475-bcaec524bf84)	Nessus	FreeBSD Local Security Checks	Local	critical
96015	Debian DSA-3736-1 : libupnp - security update	Nessus	Debian Local Security Checks	Local	critical
96009	Debian DLA-748-1 : libupnp4 security update	Nessus	Debian Local Security Checks	Local	critical
96008	Debian DLA-747-1 : libupnp security update	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2016-8863

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical