Sign-up

ID

VAR-201111-0178


CVE

CVE-2011-4499


TITLE

Portable SDK for UPnP Devices (libupnp) contains multiple buffer overflows in SSDP

Trust: 0.8

sources: CERT/CC: VU#922681

DESCRIPTION

The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware before 4.71.1, and WRT54GS v4 with firmware before 1.06.1 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. A vulnerability exists in the UPnP IGD installation and enablement of multiple versions of the Broadcom UPnP stack on the Cisco Linksys WRT54G. This vulnerability is related to the "external forwarding" vulnerability. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities SECUNIA ADVISORY ID: SA52035 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035 RELEASE DATE: 2013-01-31 DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/52035/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=52035 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device. 1) Multiple vulnerabilities are caused due to a bundled version of libupnp. For more information: SA51949 2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates. PROVIDED AND/OR DISCOVERED BY: 2) Rapid7 ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at: http://www.kb.cert.org/vuls/id/922681 Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----

Trust: 4.86

sources: NVD: CVE-2011-4499 // CERT/CC: VU#922681 // CERT/CC: VU#357851 // JVNDB: JVNDB-2011-003029 // JVNDB: JVNDB-2011-002341 // CNVD: CNVD-2011-5053 // BID: 50810 // VULHUB: VHN-52444 // PACKETSTORM: 119949 // PACKETSTORM: 119896

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2011-5053

AFFECTED PRODUCTS

vendor:ciscomodel:linksys wrt54g routerscope:eqversion:3.03.9

Trust: 1.6

vendor:ciscomodel:linksys wrt54gs routerscope:eqversion:2.09.1

Trust: 1.6

vendor:ciscomodel:linksys wrt54g routerscope:eqversion:4.20.7

Trust: 1.6

vendor:ciscomodel:linksys wrt54g routerscope:lteversion:4.20.8

Trust: 1.0

vendor:linksysmodel:wrt54gscope:eqversion:*

Trust: 1.0

vendor:linksysmodel:wrt54gscope:eqversion:2.2

Trust: 1.0

vendor:ciscomodel:linksys wrt54gs routerscope:lteversion:1.06

Trust: 1.0

vendor:linksysmodel:wrt54gsscope:eqversion:3.0

Trust: 1.0

vendor:ciscomodel:linksys wrt54gs routerscope:lteversion:4.70.6

Trust: 1.0

vendor:linksysmodel:wrt54gsscope:eqversion:2.0

Trust: 1.0

vendor:linksysmodel:wrt54gsscope:eqversion:1.0

Trust: 1.0

vendor:linksysmodel:wrt54gsscope:eqversion:4.0

Trust: 1.0

vendor:edimaxmodel:br-6104kscope:eqversion:0

Trust: 0.9

vendor:edimaxmodel:6114wgscope:eqversion:0

Trust: 0.9

vendor:canyon techmodel:cn-wf514scope:eqversion:2.08

Trust: 0.9

vendor:canyon techmodel:cn-wf512scope:eqversion:1.83

Trust: 0.9

vendor:zyxelmodel:p-330wscope:eqversion:0

Trust: 0.9

vendor:thomsonmodel:tg585 routerscope:eqversion:0

Trust: 0.9

vendor:speedtouchmodel: - scope:eqversion:5x60

Trust: 0.9

vendor:sitcommodel:wl-153scope:eqversion:0

Trust: 0.9

vendor:sitcommodel:wl-111scope:eqversion:0

Trust: 0.9

vendor:axismodel: - scope: - version: -

Trust: 0.8

vendor:ciscomodel: - scope: - version: -

Trust: 0.8

vendor:d linkmodel: - scope: - version: -

Trust: 0.8

vendor:fujitsumodel: - scope: - version: -

Trust: 0.8

vendor:huaweimodel: - scope: - version: -

Trust: 0.8

vendor:linksysmodel: - scope: - version: -

Trust: 0.8

vendor:necmodel: - scope: - version: -

Trust: 0.8

vendor:siemensmodel: - scope: - version: -

Trust: 0.8

vendor:sonymodel: - scope: - version: -

Trust: 0.8

vendor:synologymodel: - scope: - version: -

Trust: 0.8

vendor:ipitomymodel: - scope: - version: -

Trust: 0.8

vendor:canyon techmodel: - scope: - version: -

Trust: 0.8

vendor:edimax computermodel: - scope: - version: -

Trust: 0.8

vendor:linksys a division of ciscomodel: - scope: - version: -

Trust: 0.8

vendor:sitecommodel: - scope: - version: -

Trust: 0.8

vendor:sweexmodel: - scope: - version: -

Trust: 0.8

vendor:technicolormodel: - scope: - version: -

Trust: 0.8

vendor:zyxelmodel: - scope: - version: -

Trust: 0.8

vendor:ciscomodel:linksys wrt54g routerscope: - version: -

Trust: 0.8

vendor:ciscomodel:linksys wrt54gs routerscope: - version: -

Trust: 0.8

vendor:cisco linksysmodel:wrt54gscope:ltversion:firmware 4.30.5

Trust: 0.8

vendor:cisco linksysmodel:wrt54gsscope:ltversion:v1 from v3 firmware 4.71.1

Trust: 0.8

vendor:cisco linksysmodel:wrt54gsscope:ltversion:v4 firmware 1.06.1

Trust: 0.8

vendor:multiple vendorsmodel: - scope: - version: -

Trust: 0.8

vendor:linksysmodel:wrt54g beta/2.0scope:eqversion:4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8

Trust: 0.6

vendor:ciscomodel:linksys wrt54gs routerscope:eqversion:4.70.6

Trust: 0.6

vendor:ciscomodel:linksys wrt54g routerscope:eqversion:4.20.8

Trust: 0.6

vendor:ciscomodel:linksys wrt54gs routerscope:eqversion:1.06

Trust: 0.6

vendor:linksysmodel:wrt54gscope:eqversion:v4.04.20.6

Trust: 0.3

vendor:linksysmodel:wrt54gscope:eqversion:v4.04.0.7

Trust: 0.3

vendor:linksysmodel:wrt54gscope:eqversion:v3.03.3.6

Trust: 0.3

vendor:linksysmodel:wrt54gscope:eqversion:v3.03.1.3

Trust: 0.3

vendor:linksysmodel:wrt54gscope:eqversion:v2.02.4.4

Trust: 0.3

vendor:linksysmodel:wrt54g betascope:eqversion:v2.02.02.8

Trust: 0.3

vendor:linksysmodel:wrt54gscope:eqversion:v2.02.00.8

Trust: 0.3

vendor:thomsonmodel:tg585 routerscope:neversion:7.4.3.2

Trust: 0.3

vendor:speedtouchmodel: - scope:neversion:5x66.2.29

Trust: 0.3

vendor:sitcommodel:wl-153scope:neversion:1.39

Trust: 0.3

vendor:linksysmodel:wrt54gscope:neversion:v4.01.0.6

Trust: 0.3

vendor:edimaxmodel:br-6104kscope:neversion:3.25

Trust: 0.3

sources: CERT/CC: VU#922681 // CERT/CC: VU#357851 // CNVD: CNVD-2011-5053 // BID: 50810 // JVNDB: JVNDB-2011-003029 // JVNDB: JVNDB-2011-002341 // CNNVD: CNNVD-201111-361 // NVD: CVE-2011-4499

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-4499
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#357851
value: HIGH

Trust: 0.8

NVD: CVE-2011-4499
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201111-361
value: HIGH

Trust: 0.6

VULHUB: VHN-52444
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2011-4499
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CARNEGIE MELLON: VU#357851
severity: HIGH
baseScore: 9.4
vectorString: NONE
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-52444
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#357851 // VULHUB: VHN-52444 // JVNDB: JVNDB-2011-003029 // CNNVD: CNNVD-201111-361 // NVD: CVE-2011-4499

PROBLEMTYPE DATA

problemtype:CWE-16

Trust: 1.9

sources: VULHUB: VHN-52444 // JVNDB: JVNDB-2011-003029 // NVD: CVE-2011-4499

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201111-361

TYPE

configuration error

Trust: 0.6

sources: CNNVD: CNNVD-201111-361

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-003029

EXPLOIT AVAILABILITY
sources:
            
            
            CERT/CC: VU#357851

PATCH
title:Top Pageurl:http://www.cisco.com/
Trust: 0.8
title:Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5053)url:https://www.cnvd.org.cn/patchInfo/show/6023
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2011-5053 // 
            
            
            
            JVNDB: JVNDB-2011-003029

EXTERNAL IDS
db:CERT/CCid:VU#357851
Trust: 5.8
db:NVDid:CVE-2011-4499
Trust: 3.4
db:SIEMENSid:SSA-963338
Trust: 0.9
db:CERT/CCid:VU#922681
Trust: 0.9
db:JVNDBid:JVNDB-2011-003029
Trust: 0.8
db:JVNDBid:JVNDB-2011-002341
Trust: 0.8
db:CNVDid:CNVD-2011-5053
Trust: 0.6
db:NSFOCUSid:18224
Trust: 0.6
db:CNNVDid:CNNVD-201111-361
Trust: 0.6
db:BIDid:50810
Trust: 0.3
db:SECUNIAid:52035
Trust: 0.2
db:VULHUBid:VHN-52444
Trust: 0.1
db:PACKETSTORMid:119949
Trust: 0.1
db:PACKETSTORMid:119896
Trust: 0.1
sources:
            
            
            CERT/CC: VU#922681 // 
            
            
            
            CERT/CC: VU#357851 // 
            
            
            
            CNVD: CNVD-2011-5053 // 
            
            
            
            VULHUB: VHN-52444 // 
            
            
            
            BID: 50810 // 
            
            
            
            JVNDB: JVNDB-2011-003029 // 
            
            
            
            JVNDB: JVNDB-2011-002341 // 
            
            
            
            PACKETSTORM: 119949 // 
            
            
            
            PACKETSTORM: 119896 // 
            
            
            
            CNNVD: CNNVD-201111-361 // 
            
            
            
            NVD: CVE-2011-4499

REFERENCES
url:http://www.kb.cert.org/vuls/id/357851
Trust: 4.4
url:http://www.upnp-hacks.org/devices.html
Trust: 2.8
url:http://homekb.cisco.com/cisco2/ukp.aspx?vw=1&articleid=28341
Trust: 1.6
url:http://jvn.jp/cert/jvnvu357851
Trust: 1.6
url:https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
Trust: 0.9
url:https://community.rapid7.com/docs/doc-2150
Trust: 0.9
url:http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Trust: 0.9
url:http://pupnp.sourceforge.net/
Trust: 0.8
url:https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf
Trust: 0.8
url:http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp
Trust: 0.8
url:http://opentools.homeip.net/dev-tools-for-upnp
Trust: 0.8
url:http://upnp.sourceforge.net/
Trust: 0.8
url:http://www.dlink.com/us/en/technology/upnp
Trust: 0.8
url:http://jpn.nec.com/security-info/secinfo/nv13-003.html
Trust: 0.8
url:http://www.ipitomy.com/index.php/mi-security-notice-ip001
Trust: 0.8
url:http://toor.do/upnp.html
Trust: 0.8
url:http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html
Trust: 0.8
url:http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4499
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4499
Trust: 0.8
url:http://www.kb.cert.org/vuls/id/357851http
Trust: 0.6
url:http://www.nsfocus.net/vulndb/18224
Trust: 0.6
url:http://secunia.com/advisories/52035/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
Trust: 0.1
url:http://secunia.com/advisories/52035/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/blog/325/
Trust: 0.1
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp
Trust: 0.1
url:http://www.kb.cert.org/vuls/id/922681
Trust: 0.1
sources:
            
            
            CERT/CC: VU#922681 // 
            
            
            
            CERT/CC: VU#357851 // 
            
            
            
            CNVD: CNVD-2011-5053 // 
            
            
            
            VULHUB: VHN-52444 // 
            
            
            
            BID: 50810 // 
            
            
            
            JVNDB: JVNDB-2011-003029 // 
            
            
            
            JVNDB: JVNDB-2011-002341 // 
            
            
            
            PACKETSTORM: 119949 // 
            
            
            
            PACKETSTORM: 119896 // 
            
            
            
            CNNVD: CNNVD-201111-361 // 
            
            
            
            NVD: CVE-2011-4499

CREDITS
Daniel Garcia
Trust: 0.3
sources:
            
            
            BID: 50810

SOURCES
db:CERT/CCid:VU#922681
db:CERT/CCid:VU#357851
db:CNVDid:CNVD-2011-5053
db:VULHUBid:VHN-52444
db:BIDid:50810
db:JVNDBid:JVNDB-2011-003029
db:JVNDBid:JVNDB-2011-002341
db:PACKETSTORMid:119949
db:PACKETSTORMid:119896
db:CNNVDid:CNNVD-201111-361
db:NVDid:CVE-2011-4499

LAST UPDATE DATE
2025-04-11T22:52:24.255000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#922681date:2014-07-30T00:00:00
db:CERT/CCid:VU#357851date:2012-11-30T00:00:00
db:CNVDid:CNVD-2011-5053date:2011-11-25T00:00:00
db:VULHUBid:VHN-52444date:2012-03-09T00:00:00
db:BIDid:50810date:2015-03-19T08:33:00
db:JVNDBid:JVNDB-2011-003029date:2011-11-25T00:00:00
db:JVNDBid:JVNDB-2011-002341date:2011-10-12T00:00:00
db:CNNVDid:CNNVD-201111-361date:2011-11-25T00:00:00
db:NVDid:CVE-2011-4499date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CERT/CCid:VU#922681date:2013-01-29T00:00:00
db:CERT/CCid:VU#357851date:2011-10-05T00:00:00
db:CNVDid:CNVD-2011-5053date:2011-11-25T00:00:00
db:VULHUBid:VHN-52444date:2011-11-22T00:00:00
db:BIDid:50810date:2011-11-24T00:00:00
db:JVNDBid:JVNDB-2011-003029date:2011-11-25T00:00:00
db:JVNDBid:JVNDB-2011-002341date:2011-10-12T00:00:00
db:PACKETSTORMid:119949date:2013-01-31T07:26:31
db:PACKETSTORMid:119896date:2013-01-30T02:46:44
db:CNNVDid:CNNVD-201111-361date:2011-11-25T00:00:00
db:NVDid:CVE-2011-4499date:2011-11-22T11:55:04.683