ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/write.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0093-1 advisory.

  - ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability     is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This     results in other code later using attacker-controlled chunk values that exceed the length of the allocated     buffer, resulting in out-of-bounds read/write. (CVE-2023-33476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202311-12 (MiniDLNA: Multiple Vulnerabilities)

  - A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to     exfiltrate media files. (CVE-2022-26505)

  - ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability     is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This     results in other code later using attacker-controlled chunk values that exceed the length of the allocated     buffer, resulting in out-of-bounds read/write. (CVE-2023-33476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6398-1 advisory.

    It was discovered that ReadyMedia was vulnerable to DNS rebinding attacks. A remote attacker could     possibly use this issue to trick the local DLNA server to leak information. This issue only affected     Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-26505)

    It was discovered that ReadyMedia incorrectly handled certain HTTP requests using chunked transport     encoding. A remote attacker could possibly use this issue to cause buffer overflows, resulting in out-of-     bounds reads and writes. (CVE-2023-33476)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3465 advisory.

  - ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability     is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This     results in other code later using attacker-controlled chunk values that exceed the length of the allocated     buffer, resulting in out-of-bounds read/write. (CVE-2023-33476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5434 advisory.

  - ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability     is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This     results in other code later using attacker-controlled chunk values that exceed the length of the allocated     buffer, resulting in out-of-bounds read/write. (CVE-2023-33476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
192721	openSUSE 15 Security Update : minidlna (openSUSE-SU-2024:0093-1)	Nessus	SuSE Local Security Checks	critical
186269	GLSA-202311-12 : MiniDLNA: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
181945	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : ReadyMedia vulnerabilities (USN-6398-1)	Nessus	Ubuntu Local Security Checks	critical
177512	Debian DLA-3465-1 : minidlna - LTS security update	Nessus	Debian Local Security Checks	critical
177490	Debian DSA-5434-1 : minidlna - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2023-33476

critical

Tenable Plugins

critical

critical

critical

critical

critical