CVE-2012-5965

Portable SDK For Upnp - Memory Corruption

Title source: rule

Description

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long DeviceType (aka urn device) field in a UDP packet.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremoteunix

https://www.exploit-db.com/exploits/24455

View Code ZIP pw:eip

References (11)

[Various Sources] http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp

[Product] http://pupnp.sourceforge.net/ChangeLog

[Patch, US Government Resource] http://www.kb.cert.org/vuls/id/922681

[Vendor Advisory] http://www.mandriva.com/security/advisories?name=MDVSA-2013:098

[Exploit] http://www.securityfocus.com/bid/57602

[Third Party Advisory] https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0037

[Third Party Advisory] http://www.debian.org/security/2013/dsa-2614

[Third Party Advisory] http://www.debian.org/security/2013/dsa-2615

[Third Party Advisory] https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play

[Third Party Advisory] https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf

[Third Party Advisory] https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb

Scores

EPSS 0.7173

EPSS Percentile 98.7%

Details

CWE

CWE-119

Status published

Products (1)

portable_sdk_for_upnp_project/portable_sdk_for_upnp 1.3.1

Published Jan 31, 2013

Tracked Since Feb 18, 2026