Published: 07/03/2017 Updated: 03/11/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) prior to 1.6.21 allows remote malicious users to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libupnp project libupnp
debian debian linux 8.0

Debian Bug report logs - #831857 libupnp: CVE-2016-6255: write files via POST Package: src:libupnp; Maintainer for src:libupnp is Nick Leverton <nick@levertonorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 20 Jul 2016 09:06:02 UTC Severity: grave Tags: buster, jessie, patch, security, sid, str ...

Debian Bug report logs - #842093 libupnp: CVE-2016-8863 Package: src:libupnp; Maintainer for src:libupnp is Nick Leverton <nick@levertonorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 25 Oct 2016 20:30:02 UTC Severity: grave Tags: fixed-upstream, patch, security, upstream Found in version lib ...

Two vulnerabilities were discovered in libupnp, a portable SDK for UPnP devices CVE-2016-6255 Matthew Garret discovered that libupnp by default allows any user to write to the filesystem of the host running a libupnp-based server application CVE-2016-8863 Scott Tenaglia discovered a heap buffer overflow vulnerability, that can lead to ...

CTFs are fun, but what about exploiting a real bug?

Targets pupnp release-1618 running on i386 Ubuntu 1604 Fix commit 9c099c2923ab ("Fix out-of-bound access in create_url_list() (CVE-2016-8863)")

CWE-119 https://www.debian.org/security/2016/dsa-3736 https://sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLog https://sourceforge.net/p/pupnp/bugs/133/http://www.securityfocus.com/bid/92849 https://security.gentoo.org/glsa/201701-52 https://www.tenable.com/security/research/tra-2017-10 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831857 https://github.com/mephi42/CVE-2016-8863 https://www.debian.org/security/./dsa-3736

CVE-2016-8863

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect