Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.

The remote host is affected by the vulnerability described in GLSA-201801-08 (MiniUPnPc: Arbitrary code execution)

    An exploitable buffer overflow vulnerability exists in the XML parser       functionality of the MiniUPnP library.
  Impact :

    A remote attacker, by enticing a user to connect to a malicious server,       could cause the execution of arbitrary code with the privileges of the       user running a MiniUPnPc linked application.
  Workaround :

    There is no known workaround at this time.

MiniUPnP was updated to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-6031: XML parser buffer overflow (boo#950759)

Aleksandar Nikolic of Cisco Talos discovered a buffer overflow vulnerability in the XML parser functionality of miniupnpc, a UPnP IGD client lightweight library. A remote attacker can take advantage of this flaw to cause an application using the miniupnpc library to crash, or potentially to execute arbitrary code with the privileges of the user running the application.

USN-2780-1 fixed a vulnerability in the MiniUPnP library in Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 15.04. This update provides the corresponding update for Ubuntu 15.10.

Aleksandar Nikolic discovered a buffer overflow vulnerability in the XML parser functionality of the MiniUPnP library. A remote attacker could use this to cause a denial of service (application crash) or possibly execute arbitrary code with privileges of the user running an application that uses the MiniUPnP library.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2780-1 advisory.

    Aleksandar Nikolic discovered a buffer overflow vulnerability in the XML parser functionality of the     MiniUPnP library. A remote attacker could use this to cause a denial of service (application crash) or     possibly execute arbitrary code with privileges of the user running an application that uses the MiniUPnP     library.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Talos reports :

An exploitable buffer overflow vulnerability exists in the XML parser functionality of the MiniUPnP library. A specially crafted XML response can lead to a buffer overflow on the stack resulting in remote code execution. An attacker can set up a server on the local network to trigger this vulnerability.

ID	Name	Product	Family	Severity
105634	GLSA-201801-08 : MiniUPnPc: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
87006	openSUSE Security Update : miniupnpc (openSUSE-2015-789)	Nessus	SuSE Local Security Checks	medium
86582	Debian DSA-3379-1 : miniupnpc - security update	Nessus	Debian Local Security Checks	medium
86566	Ubuntu 15.10 : miniupnpc vulnerability (USN-2780-2)	Nessus	Ubuntu Local Security Checks	medium
86494	Ubuntu 14.04 LTS : MiniUPnP vulnerability (USN-2780-1)	Nessus	Ubuntu Local Security Checks	critical
86385	FreeBSD : miniupnpc -- buffer overflow (06fefd2f-728f-11e5-a371-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-6031

critical

Tenable Plugins

medium

medium

medium

medium

critical

medium