SB2013013104 - Multiple vulnerabilities in miniupnpd

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Stack-based buffer overflow (CVE-ID: CVE-2013-0230)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the ExecuteSoapAction function in the SOAPAction handler in the HTTP service when processing a long quoted method. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) NULL pointer dereference (CVE-ID: CVE-2013-1461)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a SOAPAction header that lacks a # (pound sign) character, a different vulnerability than CVE-2013-0230.

3) Input validation error (CVE-ID: CVE-2013-1462)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Integer signedness error in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to cause a denial of service (incorrect memory copy) via a SOAPAction header that lacks a " (double quote) character, a different vulnerability than CVE-2013-0230.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://www.securityfocus.com/bid/57608
• https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
• https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf
• https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb
• https://www.exploit-db.com/exploits/36839/