FreeBSD : hostapd and wpa_supplicant -- multiple vulnerabilities (bbc0db92-084c-11e5-bb90-002590263bf5)

Jouni Malinen reports : WPS UPnP vulnerability with HTTP chunked transfer encoding. 2015-2 - CVE-2015-4141 Integer underflow in AP mode WMM Action frame processing. 2015-3 - CVE-2015-4142 EAP-pwd missing payload length validation. 2015-4 - CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-414...

Realtek SDK Miniigd UPnP SOAP Command Execution Exploit

Exploit for linux platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Realtek SDK Miniigd UPnP SOAP Command Execution', 'Description' = %q Differen...

Realtek SDK - Miniigd UPnP SOAP Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Realtek SDK Miniigd UPnP SOAP Command Execution', 'Description' = %q Different devices using the Realtek SDK with the miniigd daemon...

CVE-2015-4141

The WPS UPnP function in hostapd, when using WPS AP, and wpasupplicant, when using WPS external registrar ER, 0.7.0 through 2.4 allows remote attackers to cause a denial of service crash via a negative chunk length, which triggers an out-of-bounds read or heap-based buffer overflow...

Realtek SDK Miniigd UPnP SOAP Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Realtek SDK Miniigd UPnP SOAP Command Execution', 'Description' = %q Different devices using the Realtek SDK with the miniigd daemon...

hostapd and wpa_supplicant -- multiple vulnerabilities

Jouni Malinen reports: WPS UPnP vulnerability with HTTP chunked transfer encoding. 2015-2 - CVE-2015-4141 Integer underflow in AP mode WMM Action frame processing. 2015-3 - CVE-2015-4142 EAP-pwd missing payload length validation. 2015-4 - CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146...

Realtek SDK Miniigd UPnP SOAP Command Execution

Different devices using the Realtek SDK with the miniigd daemon are vulnerable to OS command injection in the UPnP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This module has been tested successfully on a Trendnet TEW-731BR...

CVE-2015-0869

I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service SSDP reflection via UPnP requests...

Code injection

I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service SSDP reflection via UPnP requests...

CVE-2015-0869

The CVE-2015-0869 entry concerns I-O DATA DEVICE NP-BBRM routers. A vulnerability in the UPnP functionality allows remote attackers to cause a denial of service via SSDP reflection by sending UPnP requests. Affected product: NP-BBRM router. Impact: potential DoS through SSDP reflection. CVSS metr...

CVE-2015-0869

I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service SSDP reflection via UPnP requests...

JVN#27142693: NP-BBRM vulnerable in UPnP functionality

NP-BBRM provided by I-O DATA DEVICE, INC. is a LAN router. NP-BBRM contains a vulnerability in the UPnP functionality. Impact The device may be used in a DDoS attack, as a SSDP reflector. Solution Disable UPnP Disable UPnP functionality from the management configuration in the settings screen...

ZTE-and-TP-Link-RomPager

Date: 10-05-2014 Server Version: RomPager/4.07 UPnP/1.0 Tested Routers: ZTE ZXV10 W300 TP-Link TD-W8901G TP-Link TD-W8101G TP-Link TD-8840G Firmware: FwVer:3.11.2.175TC3086 HwVer:T14.F75.0 Tested on: Kali Linux x86 !/usr/bin/env python -- coding: utf-8 -- Exploit Title: ZTE and TP-Link RomPager D...

[SECURITY] Fedora 20 Update: deluge-1.3.10-1.fc20

Deluge is a new BitTorrent client, created using Python and GTK+. It is intended to bring a native, full-featured client to Linux GTK+ desktop environments such as GNOME and XFCE. It supports features such as DHT Distributed Hash Tables, PEX =C2=B5Torrent-compatible Peer Exchange, an d UPnP...

CVE-2014-8654

Multiple cross-site request forgery CSRF vulnerabilities in Compal Broadband Networks CBN CH6640E and CG6640E Wireless Gateway hardware 1.0 with firmware CH6640-3.5.11.7-NOSH allow remote attackers to hijack the authentication of administrators for requests that 1 have unspecified impact on DDNS...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Compal Broadband Networks CBN CH6640E and CG6640E Wireless Gateway hardware 1.0 with firmware CH6640-3.5.11.7-NOSH allow remote attackers to hijack the authentication of administrators for requests that 1 have unspecified impact on DDNS...

[SECURITY] Fedora 21 Update: deluge-1.3.10-1.fc21

Deluge is a new BitTorrent client, created using Python and GTK+. It is intended to bring a native, full-featured client to Linux GTK+ desktop environments such as GNOME and XFCE. It supports features such as DHT Distributed Hash Tables, PEX =C2=B5Torrent-compatible Peer Exchange, an d UPnP...

Updated MythTV packages to harden against SSDP reflection attacks

Updated MythTV packages to harden against SSDP reflection attacks MythTV's UPNP component was suseptable to SSDP reflection attacks and has been hardened to disallow SSDP device discovery from non-local addresses as mitigation. Additionally, a popular schedules retrieval service, Schedules Direct...

Reflection DDoS Attacks Using Millions of UPnP Devices on the Rise

After successful in launching reflection and amplification Distributed Denial-of-Service DDoS attacks by abusing various protocols such as DNS, NTP and SMTP, hackers are now abusing Simple Service Discovery Protocol SSDP – part of the UPnP protocol standard – to target home and office devices,...

Updated libtorrent-rasterbar packages fixes uPnP forwarding all ports

Updated libtorrent-rasterbar packages fix security vulnerability: The libtorrent-rasterbar library was opening UPNP port 0, causing all ports to be forwarded from the router to the client machine...