high7.8Public exploit code
CVE-2013-0229
The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (servic…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MiniUPnP 1.4 - Multiple Denial of Service Vulnerabilities2012-01-28 · dos · multiple · Verified
- INFOMARK IMW-C920W MiniUPnPd 1.0 - Denial of Service2015-07-07 · dos · hardware
Impact
The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Miniupnp Project | Miniupnpd | through 1.3 Versions 1.0, 1.1, 1.2 |
References
- NVD record
- CVE.org record
- https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
- https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf
- https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb
- https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
- https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf
- https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb