PT-2017-8945 · Libupnp+2 · Portable Upnp Sdk+2

Publicado 2016-07-26 · Atualizado 2021-03-15 · CVE-2016-6255

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Portable UPnP SDK (aka libupnp) versions prior to 1.6.21

Description The issue allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler. This can be achieved by sending a POST request to a specific endpoint, potentially allowing attackers to modify files on the system.

Recommendations For versions prior to 1.6.21, update to version 1.6.21 or later to resolve the issue. As a temporary workaround, consider restricting access to the webroot directory to minimize the risk of exploitation. Avoid using unregistered handlers in POST requests until the issue is resolved.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2016-2493

CVE-2016-6255

DLA-597-1

DSA-3736-1

MGASA-2016-0266

OPENSUSE-SU-2024:11006-1

USN-4794-1

Produtos afetados

Alt Linux

Portable Upnp Sdk

Ubuntu

Referências · 29

• 🔥 https://exploit-db.com/exploits/40589 · Exploit
• https://github.com/mjg59/pupnp-code/commit/be0a01bdb83395d9f3a5ea09c1308a4f1a972cbd · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6255 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6255 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2016-6255 · Nota de Segurança
• https://security.gentoo.org/glsa/201701-52 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4794-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3736-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/07/20/5 · Correção
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8863 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2016-6255 · Nota
• http://securityfocus.com/bid/92050 · Nota
• http://openwall.com/lists/oss-security/2016/07/18/13 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-6255 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-8863 · Aviso do Fabricante