PT-2014-5655 · Miniupnp+1 · Miniupnpd+1

Nanard · Publicado 2014-06-09 · Atualizado 2020-09-28 · CVE-2014-3985

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MiniUPnP version 1.9

Description The issue allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read in the getHTTPResponse function.

Recommendations For MiniUPnP version 1.9, as a temporary workaround, consider disabling the getHTTPResponse function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2014-3985

OPENSUSE-SU-2024:10434-1

USN-2280-1

Produtos afetados

Miniupnpd

Ubuntu

Referências · 17

• 🔥 http://seclists.org/oss-sec/2014/q2/496 · Exploit
• 🔥 http://seclists.org/oss-sec/2014/q2/201 · Exploit
• https://github.com/miniupnp/miniupnp/commit/3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9 · Correção
• https://security-tracker.debian.org/tracker/CVE-2014-3985 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2280-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3985 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2014-3985 · Nota de Segurança
• https://security.gentoo.org/glsa/201701-41 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-3985 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1085618 · Correção
• http://lists.opensuse.org/opensuse-updates/2014-06/msg00039.html · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-2280-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-3985 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/04/30/3 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3985 · Aviso do Fabricante