CVE-2012-5958 Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) bef...
HighCVSS 10.0
EPSS 83.2%
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a UDP packet with a crafted string that is not properly handled after a certain pointer subtraction.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libupnp project libupnp | <= 1.6.17 | No fix listed |
| libupnp project libupnp | = 1.4.0 | No fix listed |
| libupnp project libupnp | = 1.4.1 | No fix listed |
| libupnp project libupnp | = 1.4.2 | No fix listed |
| libupnp project libupnp | = 1.4.3 | No fix listed |
| libupnp project libupnp | = 1.4.4 | No fix listed |
| libupnp project libupnp | = 1.4.5 | No fix listed |
| libupnp project libupnp | = 1.4.6 | No fix listed |
| libupnp project libupnp | = 1.4.7 | No fix listed |
| libupnp project libupnp | = 1.6.0 | No fix listed |
| libupnp project libupnp | = 1.6.1 | No fix listed |
| libupnp project libupnp | = 1.6.2 | No fix listed |
| libupnp project libupnp | = 1.6.3 | No fix listed |
| libupnp project libupnp | = 1.6.4 | No fix listed |
| libupnp project libupnp | = 1.6.5 | No fix listed |
| libupnp project libupnp | = 1.6.6 | No fix listed |
| libupnp project libupnp | = 1.6.7 | No fix listed |
| libupnp project libupnp | = 1.6.8 | No fix listed |
| libupnp project libupnp | = 1.6.9 | No fix listed |
| libupnp project libupnp | = 1.6.10 | No fix listed |
| libupnp project libupnp | = 1.6.11 | No fix listed |
| libupnp project libupnp | = 1.6.12 | No fix listed |
| libupnp project libupnp | = 1.6.13 | No fix listed |
| libupnp project libupnp | = 1.6.14 | No fix listed |
| libupnp project libupnp | = 1.6.15 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| libupnp project libupnp | = 1.6.16 | No fix listed |
References
- openSUSE-SU-2013:0255 vendor-advisory
- packetstormsecurity.com
- pupnp.sourceforge.net
- 20130129 Portable SDK for UPnP Devices Contains Buffer Overflow Vulnerabilities vendor-advisory
- tsd.dlink.com.tw
- tsd.dlink.com.tw
- tsd.dlink.com.tw
- tsd.dlink.com.tw
- DSA-2614 vendor-advisory
- DSA-2615 vendor-advisory
- VU#922681 patch third-party-advisory us-government-resource
- MDVSA-2013:098 vendor-advisory
- 57602 exploit vdb-entry
- community.rapid7.com
- community.rapid7.com
- community.rapid7.com
- wiki.mageia.org
- www.tenable.com