Vulnerability CVE-2013-0230
Published: 2013-01-31   Modified: 2013-02-01

Description:
Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to execute arbitrary code via a long quoted method.

See advisories in our WLB2 database:
Topic
Author
Date
High
MiniUPnPd 1.0 Stack Buffer Overflow Remote Code Execution
Dejan Lukan
05.06.2013
Med.
MiniUPnPd 1.0 Stack Overflow RCE for AirTies RT Series
Onur ALANBEL
28.04.2015
Med.
MiniUPNPd 1.0 Remote Denial Of Service
Todor Donev
08.07.2015

Type:

CWE-119

 (Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Miniupnp project -> Miniupnpd 

 References:
http://www.securityfocus.com/bid/57608
https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf
https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb
https://www.exploit-db.com/exploits/36839/
Copyright 2024, cxsecurity.com

 

Back to Top