MiniUPnP < 1.9 Multiple Vulnerabilities

This script is Copyright (C) 2015-2016 Tenable Network Security, Inc.


Synopsis :

A network service running on the remote host has multiple
vulnerabilities.

Description :

According to its banner, the version of MiniUPnP running on the remote
host is prior to 1.9. It is, therefore, affected by the following
vulnerabilities :

- An unspecified flaw exists in the Domain Name System
(DNS) related to the 'rebinding' interaction. An
unauthenticated, remote attacker can exploit this, by
convincing a user to visit a specially crafted web page,
to run a client-side script that interacts with the
systems on their network. (VulnDB 115649)

- A flaw exists in the GetListOfPortMappings() function
within file upnpsoap.c due to improper sanitization of
user-supplied input when handling SOAP connections. An
unauthenticated, remote attacker can exploit this,
via a specially crafted request, to corrupt memory,
resulting in a denial of service condition or the
execution of arbitrary code. (VulnDB 115652)

- A buffer overflow condition exists in the
ParseHttpHeaders() function within file upnphttp.c due
to improper validation of user-supplied input when
handling Content-Length HTTP headers. An
unauthenticated, remote attacker can exploit this, via a
specially crafted request, to cause a denial of service
condition or the execution of arbitrary code.
(VulnDB 115653)

- A flaw exists in the BuildHeader_upnphttp() function
within file upnphttp.c due to insufficient checking for
memory allocation failures. An unauthenticated, remote
attacker can exploit this to have an unspecified impact.
(VulnDB 115661)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.

See also :

http://www.nessus.org/u?7516605f

Solution :

Upgrade to MiniUPnP version 1.9 or later.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.7
(CVSS2#E:ND/RL:OF/RC:ND)
Public Exploit Available : false

Family: Misc.

Nessus Plugin ID: 80889 ()

Bugtraq ID: 71624

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now