PT-2014-5655 · Miniupnp+1 · Miniupnpd+1

Nanard · Published 2014-06-09 · Updated 2020-09-28 · CVE-2014-3985

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MiniUPnP version 1.9

Description The issue allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read in the getHTTPResponse function.

Recommendations For MiniUPnP version 1.9, as a temporary workaround, consider disabling the getHTTPResponse function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2014-3985

OPENSUSE-SU-2024:10434-1

USN-2280-1

Affected Products

Miniupnpd

Ubuntu

References · 17

• 🔥 http://seclists.org/oss-sec/2014/q2/496 · Exploit
• 🔥 http://seclists.org/oss-sec/2014/q2/201 · Exploit
• https://github.com/miniupnp/miniupnp/commit/3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9 · Patch
• https://security-tracker.debian.org/tracker/CVE-2014-3985 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2280-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3985 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-3985 · Security Note
• https://security.gentoo.org/glsa/201701-41 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3985 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1085618 · Patch
• http://lists.opensuse.org/opensuse-updates/2014-06/msg00039.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2280-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3985 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3985 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3985 · Vendor Advisory