NetSight
IP …
critical10.0Public exploit code

CVE-2012-5959

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, for…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a long UDN (aka uuid) field within a string that contains a :: (colon colon) in a UDP packet.

Affected products

VendorProductAffected versions
Portable Sdk For Upnp ProjectPortable Sdk For Upnp
through 1.6.17
Versions 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4

Weakness classification

CWE-119

References