Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2013:098 | First vendor Publication | 2013-04-10 |
| Vendor | Mandriva | Last vendor Modification | 2013-04-10 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Updated libupnp packages fix security vulnerabilities: The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet (CVE-2012-5958, CVE-2012-5959, CVE-2012-5960, CVE-2012-5961, CVE-2012-5962, CVE-2012-5963, CVE-2012-5964, CVE-2012-5965). |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2013:098 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:18527 | |||
| Oval ID: | oval:org.mitre.oval:def:18527 | ||
| Title: | DSA-2615-1 libupnp4 - several | ||
| Description: | Multiple stack-based buffer overflows were discovered in libupnp4, a library used for handling the Universal Plug and Play protocol. HD Moore from Rapid7 discovered that SSDP queries where not correctly handled by the unique_service_name() function. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2615-1 CVE-2012-5958 CVE-2012-5959 CVE-2012-5960 CVE-2012-5961 CVE-2012-5962 CVE-2012-5963 CVE-2012-5964 CVE-2012-5965 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | libupnp4 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:19870 | |||
| Oval ID: | oval:org.mitre.oval:def:19870 | ||
| Title: | DSA-2614-1 libupnp - several | ||
| Description: | Multiple stack-based buffer overflows were discovered in libupnp, a library used for handling the Universal Plug and Play protocol. HD Moore from Rapid7 discovered that SSDP queries where not correctly handled by the unique_service_name() function. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2614-1 CVE-2012-5958 CVE-2012-5959 CVE-2012-5960 CVE-2012-5961 CVE-2012-5962 CVE-2012-5963 CVE-2012-5964 CVE-2012-5965 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | libupnp |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2018-05-23 | libupnp command buffer overflow attempt RuleID : 44743-community - Revision : 3 - Type : SERVER-OTHER |
| 2017-12-07 | libupnp command buffer overflow attempt RuleID : 44743 - Revision : 3 - Type : SERVER-OTHER |
| 2014-01-10 | libupnp command buffer overflow attempt RuleID : 25620 - Revision : 4 - Type : SERVER-OTHER |
| 2014-01-10 | libupnp command buffer overflow attempt RuleID : 25619 - Revision : 4 - Type : SERVER-OTHER |
| 2014-01-10 | libupnp command buffer overflow attempt RuleID : 25618 - Revision : 4 - Type : SERVER-OTHER |
| 2014-01-10 | libupnp command buffer overflow attempt RuleID : 25617 - Revision : 4 - Type : SERVER-OTHER |
| 2014-01-10 | libupnp command buffer overflow attempt RuleID : 25612 - Revision : 4 - Type : SERVER-OTHER |
| 2014-01-10 | libupnp command buffer overflow attempt RuleID : 25601 - Revision : 4 - Type : SERVER-OTHER |
| 2018-05-23 | libupnp command buffer overflow attempt RuleID : 25589-community - Revision : 6 - Type : SERVER-OTHER |
| 2014-01-10 | libupnp command buffer overflow attempt RuleID : 25589 - Revision : 6 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-90.nasl - Type : ACT_GATHER_INFO |
| 2014-03-27 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201403-06.nasl - Type : ACT_GATHER_INFO |
| 2013-04-20 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-098.nasl - Type : ACT_GATHER_INFO |
| 2013-02-21 | Name : The remote Fedora host is missing a security update. File : fedora_2013-2352.nasl - Type : ACT_GATHER_INFO |
| 2013-02-21 | Name : The remote Fedora host is missing a security update. File : fedora_2013-2377.nasl - Type : ACT_GATHER_INFO |
| 2013-02-13 | Name : The remote Fedora host is missing a security update. File : fedora_2013-1713.nasl - Type : ACT_GATHER_INFO |
| 2013-02-13 | Name : The remote Fedora host is missing a security update. File : fedora_2013-1734.nasl - Type : ACT_GATHER_INFO |
| 2013-02-13 | Name : The remote Fedora host is missing a security update. File : fedora_2013-1765.nasl - Type : ACT_GATHER_INFO |
| 2013-02-04 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2614.nasl - Type : ACT_GATHER_INFO |
| 2013-02-04 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2615.nasl - Type : ACT_GATHER_INFO |
| 2013-02-01 | Name : A network service running on the remote host is affected by multiple remote c... File : libupnp_1_6_18.nasl - Type : ACT_GATHER_INFO |
| 2013-01-31 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_2ea6ce3d6afd11e29d4ebcaec524bf84.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:43:36 |
|
| 2013-04-10 13:18:28 |
|
