From fd60857091e752bac2c28c27c34ea4b896136bcc Mon Sep 17 00:00:00 2001 From: Pawel Pekala Date: Tue, 27 Dec 2016 16:07:23 +0000 Subject: [PATCH] Document devel/upnp 2 security vulnerabilities: - unhandled write of files to filesystem via POST by default - heap buffer overflow in create_url_list function --- security/vuxml/vuln.xml | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index d9662a7a17b5..aabfec4af78b 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,45 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + upnp -- multiple vulnerabilities + + + upnp + 1.6.21 + + + + +

Matthew Garett reports:

+
+

Reported this to upstream 8 months ago without response, + so: libupnp's default behaviour allows anyone to write to your + filesystem. Seriously. Find a device running a libupnp based server + (Shodan says there's rather a lot), and POST a file to /testfile. + Then GET /testfile ... and yeah if the server is running as root + (it is) and is using / as the web root (probably not, but maybe) + this gives full host fs access.

+
+

Scott Tenaglia reports:

+
+

There is a heap buffer overflow vulnerability in the + create_url_list function in upnp/src/gena/gena_device.c.

+
+ + + + https://twitter.com/mjg59/status/755062278513319936 + https://sourceforge.net/p/pupnp/bugs/133/ + CVE-2016-6255 + CVE-2016-8863 + + + 2016-02-23 + 2016-12-27 + + + phpmailer -- Remote Code Execution