CVE-2016-8863

CRITICAL
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2016-8863 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Proofs of concept

1

Repository PoCs

GitHubmephi42/CVE-2016-8863Repository PoCby mephi421Not analyzed491 files

3.6 MiB

GitHub
PoC details

Docker lab environments

1
GitHub

i386-xenial/image

mephi42/CVE-2016-8863Created Vuln labCVE-2016-8863Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A multi-stage Docker build that compiles libupnp 1.6.18 in an i386/ubuntu:xenial stage, then creates an ubuntu:focal analysis container with debugging tools (gdb, gdbserver, pwntools, gef) and copies the i386 root filesystem into it.

i386-xenial/image/Dockerfile:1-47

Lab assessment

Vulnerability lab

The README explicitly links the environment to CVE-2016-8863, a known vulnerability in libupnp, and the Dockerfile builds the vulnerable release-1.6.18 of pupnp alongside exploit-development tools (pwntools, gef).

README.md:1-10i386-xenial/image/Dockerfile:1-47
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

i386-xenial build stage

vulnerable target compilation

Builds libupnp 1.6.18 from source on i386/ubuntu:xenial with debug flags (-g -O0) and downloads glibc source for debugging.

i386-xenial/image/Dockerfile:1-24

ubuntu:focal analysis stage

exploit development environment

Installs gdb, gdbserver, pwntools, and gef; copies the i386 root filesystem from the build stage; creates a debug symlink for glibc.

i386-xenial/image/Dockerfile:26-47
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2016-8863

Supported by supplied evidence

The README states the target is pupnp release-1.6.18 and references the fix commit for CVE-2016-8863. The Dockerfile builds that exact release and includes exploit-development tooling.

README.md:1-10i386-xenial/image/Dockerfile:17-19
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker build environment capable of multi-stage builds and pulling i386/ubuntu:xenial and ubuntu:focal base images.i386-xenial/image/Dockerfile:1-2
  • Network access during build to download apt packages, pupnp source, pwntools, and gef.i386-xenial/image/Dockerfile:5-14i386-xenial/image/Dockerfile:17-19i386-xenial/image/Dockerfile:37-38

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.i386-xenial/image/Dockerfile:1-47
  2. Run a container from the built image to obtain a shell with gdb, pwntools, and the vulnerable libupnp binaries available under /i386-xenial.i386-xenial/image/Dockerfile:26-47
  3. Use the included debugging tools to analyze or exploit the out-of-bound access vulnerability (CVE-2016-8863) in the compiled libupnp.README.md:1-10
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile only builds a vulnerable library and installs standard debugging tools. No RUN, CMD, or ENTRYPOINT executes any exploit or connects to external systems at runtime. The environment is self-contained for vulnerability research.

i386-xenial/image/Dockerfile:1-47
Review boundaries

What the analysis did not establish

  • No runtime CMD/ENTRYPOINT is defined; the intended exploitation workflow is not fully specified.
  • The pwntools fork (mephi42/pwntools) and gef script are fetched from external URLs without integrity verification.
  • The analysis container runs as root by default, which is typical for debugging but could be hardened.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

7