Vulnerability Note VU#922681
Portable SDK for UPnP Devices (libupnp) contains multiple buffer overflows in SSDP
The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet.
Universal Plug and Play (UPnP) is a set of network protocols designed to support automatic discovery and service configuration. The Portable SDK for UPnP Devices (libupnp) is an open source project that has its roots in the Linux SDK for UPnP Devices and software from Intel (Intel Tools for UPnP Technologies and later Developer Tools for UPnP Technologies). Intel no longer maintains or supports these tools. Many different vendors produce UPnP-enabled devices that use libupnp.
As part of a large scale security research project, Rapid7 investigated internet-connected UPnP devices and found, among other security issues, multiple buffer overflow vulnerabilities in the libupnp implementation of the Simple Service Discovery Protocol (SSDP). Rapid7's report summarizes these vulnerabilities:
A remote, unauthenticated attacker may be able to execute arbitrary code on the device or cause a denial of service.
Apply an Update
Vendor Information (Learn More)
We attempted to notify more than 200 vendors identified by Rapid7 as running libupnp. The following list includes vendors who responded to our notification and vendors for whom we had existing security contact information.
|Vendor||Status||Date Notified||Date Updated|
|Axis||Affected||13 Dec 2012||05 Apr 2013|
|Cisco Systems, Inc.||Affected||13 Dec 2012||29 Jan 2013|
|D-Link Systems, Inc.||Affected||13 Dec 2012||31 Jan 2013|
|Fujitsu Technology||Affected||10 Jan 2013||29 Jan 2013|
|Huawei Technologies||Affected||13 Dec 2012||29 Jan 2013|
|ipitomy||Affected||08 Jan 2013||01 Feb 2013|
|Linksys||Affected||13 Dec 2012||29 Jan 2013|
|NEC Corporation||Affected||13 Dec 2012||29 Jan 2013|
|Siemens||Affected||13 Dec 2012||30 Jan 2013|
|Sony Corporation||Affected||13 Dec 2012||30 Jan 2013|
|Synology||Affected||13 Dec 2012||28 Feb 2013|
|teldat||Not Affected||-||05 Feb 2013|
|Ubiquiti Networks||Not Affected||09 Jan 2013||29 Jan 2013|
|Yamaha Corporation||Not Affected||-||01 Feb 2013|
|3com Inc||Unknown||13 Dec 2012||29 Jan 2013|
CVSS Metrics (Learn More)
Thanks to HD Moore of Rapid7 for reporting this vulnerability, and Tod Beardsley for coordination support.
This document was written by Jared Allar.
- CVE IDs: CVE-2012-5958 CVE-2012-5959 CVE-2012-5960 CVE-2012-5961 CVE-2012-5962 CVE-2012-5963 CVE-2012-5964 CVE-2012-5965
- Date Public: 29 Jan 2013
- Date First Published: 29 Jan 2013
- Date Last Updated: 30 Jul 2014
- Document Revision: 69
If you have feedback, comments, or additional information about this vulnerability, please send us email.