PT-2013-2172 · Miniupnp · Miniupnpd

Hd Moore · Publicado 2013-01-31 · Atualizado 2015-10-08 · CVE-2013-0229

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MiniUPnPd versions prior to 1.4

Description The issue is related to the ProcessSSDPRequest function in the SSDP handler, which can be exploited by remote attackers to cause a denial of service. This is achieved by sending a crafted request that triggers a buffer over-read, resulting in the service crashing.

Recommendations For versions prior to 1.4, update to version 1.4 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2013-0229

Produtos afetados

Miniupnpd

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/upnp/miniupnpd_dos.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/upnp/ssdp_msearch.rb · Exploit
• 🔥 https://exploit-db.com/exploits/38249 · Exploit
• 🔥 https://exploit-db.com/exploits/37517 · Exploit
• https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb · Nota
• https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play · Nota
• https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-0229 · Nota de Segurança