Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4794-1 advisory.

    Matthew Garrett discovered that libupnp mishandled POST requests by default. An attacker could use this     vulnerability to write files to arbitrary locations in the victim's filesystem, possibly as root.
    (CVE-2016-6255)

    It was discovered that libupnp mishandled certain input. A remote attacker could use this vulnerability to     cause a denial of service (crash) or possibly execute arbitrary code. (CVE-2016-8863)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- miniserver: fix binding to ipv6 link-local addresses

  - Fix out-of-bound access in create_url_list()     (CVE-2016-8863)

  - If the error or info log files can not be created, use     stderr and stdout instead.

  - SF Bug Tracker #132 CVE-2016-6255: write files via POST

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to libupnp 1.6.21 fixes the following security issues :

  - various string handling issues (bsc#898167)

  - CVE-2016-8863: out-of-bounds access (bsc#1006256)

  - CVE-2016-6255: fix for file write via POST (bsc#989948)

The remote host is affected by the vulnerability described in GLSA-201701-52 (libupnp: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libupnp. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attack could arbitrarily write files to a users file system,       cause a Denial of Service condition, or execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

Matthew Garett reports :

Reported this to upstream 8 months ago without response, so: libupnp's default behaviour allows anyone to write to your filesystem.
Seriously. Find a device running a libupnp based server (Shodan says there's rather a lot), and POST a file to /testfile. Then GET /testfile ... and yeah if the server is running as root (it is) and is using / as the web root (probably not, but maybe) this gives full host fs access.

Scott Tenaglia reports :

There is a heap buffer overflow vulnerability in the create_url_list function in upnp/src/gena/gena_device.c.

Two vulnerabilities were discovered in libupnp, a portable SDK for UPnP devices.

  - CVE-2016-6255     Matthew Garret discovered that libupnp by default allows     any user to write to the filesystem of the host running     a libupnp-based server application.

  - CVE-2016-8863     Scott Tenaglia discovered a heap buffer overflow     vulnerability, that can lead to denial of service or     remote code execution.

The Portable SDK for UPnP Devices (libupnp) running on the remote host is affected by a flaw that is triggered when handling HTTP POST or GET requests. An unauthenticated, remote attacker can exploit this to write arbitrary files to the web server file system.

It has been discovered that libupnp's default behaviour allows anyone to write to the filesystem of the system running a libupnp-based server application.

For Debian 7 'Wheezy', these problems have been fixed in version 1.6.17-1.2+deb7u1.

We recommend that you upgrade your libupnp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183693	Ubuntu 16.04 ESM : libupnp vulnerabilities (USN-4794-1)	Nessus	Ubuntu Local Security Checks	critical
101590	Fedora 26 : libupnp (2017-23535a31f8)	Nessus	Fedora Local Security Checks	critical
100612	openSUSE Security Update : libupnp (openSUSE-2017-650)	Nessus	SuSE Local Security Checks	critical
97702	Fedora 24 : libupnp (2017-3bd0b2e2c0)	Nessus	Fedora Local Security Checks	critical
97674	Fedora 25 : libupnp (2017-2c29702300)	Nessus	Fedora Local Security Checks	critical
96687	GLSA-201701-52 : libupnp: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
96163	FreeBSD : upnp -- multiple vulnerabilities (244c8288-cc4a-11e6-a475-bcaec524bf84)	Nessus	FreeBSD Local Security Checks	critical
96015	Debian DSA-3736-1 : libupnp - security update	Nessus	Debian Local Security Checks	critical
93221	Portable SDK for UPnP Devices (libupnp) HTTP Arbitrary File Write	Nessus	Misc.	high
93017	Debian DLA-597-1 : libupnp security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-6255

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

high

high