Buffer overflow in Libupnp Project
CVE-2012-5958
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a UDP packet with a crafted string that is not properly handled after a certain pointer subtraction.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 10.0 (High). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.832 (99.7th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.832 · newest: 0.832 · change: 0.000
Affected products
- Libupnp Project — versions 1.4.0, 1.4.1, 1.4.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129… (vendor-advisory)
- www.mandriva.com/security/advisories (vendor-advisory)
- tsd.dlink.com.tw/temp/PMD/12960/DSR-150N_A2_Release_Notes_FW_v1.05B64_WW.pdf
- community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPn…
- tsd.dlink.com.tw/temp/PMD/12879/DSR-500_500N_1000_1000N_A1_Release_Notes_FW_v1…
- www.debian.org/security/2013/dsa-2615 (vendor-advisory)
- tsd.dlink.com.tw/temp/PMD/12966/DSR-150_A1_A2_Release_Notes_FW_v1.08B44_WW.pdf
- tsd.dlink.com.tw/temp/PMD/13039/DSR-250_250N_A1_A2_Release_Notes_FW_v1.08B44_WW…
- www.debian.org/security/2013/dsa-2614 (vendor-advisory)
- www.securityfocus.com/bid/57602 (Exploit, vdb-entry)
Frequently asked questions
- What is CVE-2012-5958?
- CVE-2012-5958 is a vulnerability in Libupnp Project, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2013-01-31.
- Is CVE-2012-5958 known to be exploited?
- 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.