Input validation error in Universal Plug and Play (UPnP) - CVE-2020-12695

Vulnerability identifier: #VU28948

CSH Severity: Medium

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12695

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a distributed denial of service (DDoS) attack.

The vulnerability exists due to a CallStranger issue in the UPnP SUBSCRIBE functionality. A remote attacker can send traffic to arbitrary destinations, leading to amplified DDoS attacks and data exfiltration.

Universal Plug and Play (UPnP)
Huawei E6878-370
Debian Linux
Arch Linux
Fedora
Red Hat Enterprise Linux for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Slackware Linux
Ubuntu
openEuler
minidlna (Debian package)
minidlna (Alpine package)
hostapd (Alpine package)
gssdp
gssdp (Red Hat package)
gupnp
gupnp (Red Hat package)
minidlna (Ubuntu package)
libgupnp-1.2-0 (Ubuntu package)
gupnp-debuginfo
gupnp-debugsource
gupnp-devel
gupnp-help
hostapd (Ubuntu package)
wpasupplicant (Ubuntu package)
wpa (Debian package)
hostapd

Install updates from vendor's website.

Universal Plug and Play (UPnP) - update to 2020-04-17
Huawei E6878-370 - update to 10.0.5.1(H612SP5C233)
minidlna (Debian package) - update to 1.2.1+dfsg-2+deb10u1
minidlna (Alpine package) - update to 1.2.1-r2
hostapd (Alpine package) - update to 2.7-r6
gssdp - addressed in versions 1.0.4-1.fc31, 1.0.4-1.fc32
gssdp (Red Hat package) - update to 1.0.5-1.el8
gupnp - addressed in versions 1.0.5-1.fc31, 1.0.5-1.fc32
gupnp (Red Hat package) - update to 1.0.6-1.el8
minidlna (Ubuntu package) - addressed in versions 1.1.5+dfsg-2ubuntu0.1, 1.2.1+dfsg-2ubuntu0.1, 1.2.1+dfsg-1ubuntu0.18.04.1, 1.2.1+dfsg-1ubuntu0.20.04.1
libgupnp-1.2-0 (Ubuntu package) - update to 1.2.3-0ubuntu0.20.04.1
gupnp-debuginfo - update to 1.2.4-1
gupnp-debugsource - update to 1.2.4-1
gupnp-devel - update to 1.2.4-1
gupnp - update to 1.2.4-1
gupnp-help - update to 1.2.4-1
hostapd (Ubuntu package) - addressed in versions 1:2.1-0ubuntu1.7+esm3, 1:2.4-0ubuntu6.7, 2:2.6-15ubuntu2.7, 2:2.9-1ubuntu4.2, 2:2.9-1ubuntu8.1
wpasupplicant (Ubuntu package) - addressed in versions 2.1-0ubuntu1.7+esm3, 2.4-0ubuntu6.7, 2:2.6-15ubuntu2.7, 2:2.9-1ubuntu4.2, 2:2.9-1ubuntu8.1
wpa (Debian package) - update to 2:2.7+git20190128+0c1e29f-6+deb10u3
hostapd - addressed in versions 2.9-3.el7, 2.9-4.el8, 2.9-4.fc32

• Exploit #8226 - CallStranger (CallStranger (CVE-2020-12695) vulnerability.) (August 7, 2022)
• Exploit #3042 - callstranger-detector (Zeek Plugin that detects CallStranger (CVE-2020-12695) attempts (http://callstranger.com/)) (June 19, 2020)
• Exploit #3030 - CallStranger (Vulnerability checker for Callstranger (CVE-2020-12695)) (June 16, 2020)

• http://www.openwall.com/lists/oss-security/2020/06/08/2
• https://github.com/yunuscadirci/CallStranger
• https://www.callstranger.com
• https://www.kb.cert.org/vuls/id/339275
• https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of

• Denial of service in Open Connectivity Foundation Universal Plug and Play (UPnP)
• CallStranger Vulnerability in Huawei E6878-370
• Input validation error in hostapd (Alpine package)
• Debian update for minidlna
• Arch Linux update for hostapd
• Input validation error in minidlna (Alpine package)
• Red Hat Enterprise Linux 8 update for gssdp and gupnp
• Slackware update for wpa_supplicant
• Ubuntu update for minidlna
• Ubuntu update for wpa
• Ubuntu update for wpa
• Debian update for wpa
• openEuler 20.03 LTS SP1 update for gupnp
• Ubuntu update for gupnp
• Fedora 31 update for gssdp, gupnp
• Fedora 32 update for gssdp, gupnp
• Fedora 32 update for hostapd
• Fedora EPEL 8 update for hostapd
• Fedora EPEL 7 update for hostapd