{"vuid":"VU#922681","idnumber":"922681","name":"Portable SDK for UPnP Devices (libupnp) contains multiple buffer overflows in SSDP","keywords":["libupnp","upnp","buffer","overflow"],"overview":"The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet.","clean_desc":"Universal Plug and Play (UPnP) is a set of network protocols designed to support automatic discovery and service configuration. The Portable SDK for UPnP Devices (libupnp) is an open source project that has its roots in the Linux SDK for UPnP Devices and software from Intel (Intel Tools for UPnP Technologies and later Developer Tools for UPnP Technologies). Intel no longer maintains or supports these tools. Many different vendors produce UPnP-enabled devices that use libupnp. As part of a large scale security research project, Rapid7 investigated internet-connected UPnP devices and found, among other security issues, multiple buffer overflow vulnerabilities in the libupnp implementation of the Simple Service Discovery Protocol (SSDP). Rapid7's report summarizes these vulnerabilities: Portable SDK for UPnP Devices unique_service_name() Buffer Overflows The libupnp library is vulnerable to multiple stack-based buffer overflows when handling malicious SSDP requests. This library is used by tens of millions of deployed network devices, of which approximately twenty million are exposed directly to the internet. In addition to network devices, many streaming media and file sharing applications are also exposed to attack through this library. This advisory does not address historic or current vulnerabilities in the HTTP and SOAP processing code of libupnp. Affected Versions\nVersions 1.2 (Intel SDK) and 1.2.1a - 1.8.0 (Portable SDK) are affected by at least three remotely exploitable buffer overflows in the unique_service_name() function, which is called to process incoming SSDP requests on UDP port 1900. Additionally, versions prior to 1.6.17 are vulnerable to additional issues in the same function. Please see Appendix A for a review of the vulnerable code by version. Affected Vendors\nHundreds of vendors have used the libupnp library in their products, many of which are acting as the home routers for consumer networks. Any application linking to libupnp is likely to be affected and a list of confirmed vendors and products is provided in Appendix B. Additional details may be found in a paper and advisory from Rapid7.","impact":"A remote, unauthenticated attacker may be able to execute arbitrary code on the device or cause a denial of service.","resolution":"Apply an Update libupnp 1.6.18 has been released to address these vulnerabilities.","workarounds":"Restrict Access Deploy firewall rules to block untrusted hosts from being able to access port 1900/udp. Disable UPnP Consider disabling UPnP on the device if it is not absolutely necessary.","sysaffected":"We attempted to notify more than 200 vendors identified by","thanks":"Thanks to HD Moore of Rapid7 for reporting this vulnerability, and Tod Beardsley for coordination support.","author":"This document was written by Jared Allar.","public":["http://pupnp.sourceforge.net/","https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play","https://community.rapid7.com/docs/DOC-2150","https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf","http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp","http://www.kb.cert.org/vuls/id/357851","http://opentools.homeip.net/dev-tools-for-upnp","http://upnp.sourceforge.net/"],"cveids":["CVE-2012-5958","CVE-2012-5959","CVE-2012-5960","CVE-2012-5961","CVE-2012-5962","CVE-2012-5963","CVE-2012-5964","CVE-2012-5965"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2012-11-27T22:00:32Z","publicdate":"2013-01-29T00:00:00Z","datefirstpublished":"2013-01-29T13:14:27Z","dateupdated":"2014-07-30T19:13:26Z","revision":69,"vrda_d1_directreport":"1","vrda_d1_population":"4","vrda_d1_impact":"3","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"udp","cvss_accessvector":"N","cvss_accesscomplexity":"L","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"C","cvss_availabilityimpact":"C","cvss_exploitablity":null,"cvss_remediationlevel":"OF","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"M","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"10","cvss_basevector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","cvss_temporalscore":"8.7","cvss_environmentalscore":"6.5214078048","cvss_environmentalvector":"CDP:ND/TD:M/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}