CVE-2013-0229
EXPLOITEDminiupnpd < 1.4 - Denial of Service via Crafted SSDP Request
Title source: llmExploitation Summary
CVE-2013-0229 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 5 public exploits from researchers including Rapid7, lochiiconnectivity, hdm, Dejan Lukan, including a Metasploit module auxiliary/dos/upnp/miniupnpd_dos.
AI-analyzed exploit summary This exploit demonstrates a denial-of-service vulnerability in MiniUPnP versions prior to 1.4 by sending a malformed M-SEARCH request without proper CRLF termination, causing a crash or hang.
Description
The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.
Exploits (5)
This exploit demonstrates a denial-of-service vulnerability in MiniUPnP versions prior to 1.4 by sending a malformed M-SEARCH request without proper CRLF termination, causing a crash or hang.
This Perl script scans for UPnP devices vulnerable to CVE-2013-0229, CVE-2013-0230, CVE-2012-5958, and CVE-2012-5959 by sending an M-SEARCH request and analyzing the response for known vulnerable software versions.
This Perl script exploits CVE-2013-0229 by sending a malformed SSDP packet to miniupnpd/1.0, causing a denial of service (DoS). It crafts a raw UDP packet with an oversized payload to trigger the vulnerability.
This Metasploit module exploits a denial-of-service vulnerability in MiniUPnPd 1.4 by sending a malformed UDP M-SEARCH packet. The exploit causes the service to crash by overflowing the stack with arbitrary characters.
This Metasploit module scans for UPnP SSDP endpoints and identifies vulnerabilities in MiniUPnPd and Portable SDK for UPnP devices. It sends M-SEARCH probes and analyzes responses to detect vulnerable versions.