mailing list archives
Portable SDK for UPnP Devices (libupnp) contains multiple buffer overflows in SSDP
From: Jeffrey Walton <noloader () gmail com>
Date: Tue, 29 Jan 2013 10:19:27 -0500
Its too bad many folks are too l33t to use things like FORTIFY_SOURCE
or safer string/memory functions.
There's a reason companies like Microsoft and Apple maintain banned
function lists (http://msdn.microsoft.com/en-us/library/bb288454.aspx
How many home routers are vulnerable?
The Portable SDK for UPnP Devices libupnp library contains multiple
buffer overflow vulnerabilities. Devices that use libupnp may also
accept UPnP queries over the WAN interface, therefore exposing the
vulnerabilitites to the internet.
Universal Plug and Play (UPnP) is a set of network protocols designed
to support automatic discovery and service configuration. The Portable
SDK for UPnP Devices (libupnp) has its roots in the Linux SDK for UPnP
Devices and software from Intel (Intel Tools for UPnP Technologies and
later Developer Tools for UPnP Technologies). Many different vendors
produce UPnP-enabled devices that use libupnp.
Fun and Misc security discussion for OT posts.
Note: funsec is a public and open mailing list.
- Portable SDK for UPnP Devices (libupnp) contains multiple buffer overflows in SSDP Jeffrey Walton (Jan 29)