Operating System:

[UNIX/Linux][Debian]

Published:

26 October 2015

Protect yourself against future threats.

//Service

Security Bulletins

Receive up to date and consistent security bulletins across a wide range of vendors, streamlining security patching.

Read more
Resources > Security Bulletins > ESB-2015.2687 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2015.2687
                         miniupnpc security update
                              26 October 2015

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           miniupnpc
Publisher:         Debian
Operating System:  Debian GNU/Linux 7
                   Debian GNU/Linux 8
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Denial of Service               -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-6031  

Original Bulletin: 
   http://www.debian.org/security/2015/dsa-3379

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Debian. It is recommended that administrators 
         running miniupnpc check for an updated version of the software for 
         their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3379-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
October 25, 2015                      https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : miniupnpc
CVE ID         : CVE-2015-6031
Debian Bug     : 802650

Aleksandar Nikolic of Cisco Talos discovered a buffer overflow
vulnerability in the XML parser functionality of miniupnpc, a UPnP IGD
client lightweight library. A remote attacker can take advantage of this
flaw to cause an application using the miniupnpc library to crash, or
potentially to execute arbitrary code with the privileges of the user
running the application.

For the oldstable distribution (wheezy), this problem has been fixed
in version 1.5-2+deb7u1.

For the stable distribution (jessie), this problem has been fixed in
version 1.9.20140610-2+deb8u1.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your miniupnpc packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWLM0IAAoJEAVMuPMTQ89EcZcP/31jm2VXXuvZde4soGi3GE/Z
ZkXb1vUPb3kNY2KgtZvcMtzx78Ma6aY3zykmbfH9kwcbaEWHZ3CYXGC7zdWaFJMP
J2UpzJl5gPUlniNj1Kn9qQDKP4HM5pV3ZmxHmjZL4gtmdtsY9QujDh1wR23g/2be
rqnwKJNxEivYlElHEMPqvfYQ/ZVIOUQclTnVetGgEU6lPSrluhMF82cCZXg0z58w
wGMKJhYz6qDxhnG4D2166yiwBnoDtQFuKFRJ0ehGWGjJSc1zMuBfyM3ZCNHTjezJ
7ZWvXBNUFK6prrRphFz4767CTQWQy4EqMSncz6QpZGi70D83gpv4fNnts+T8Tqfw
9yEtdsZ/VYJOymsb/CsKRp1L3GG/3+MDfGSsb4nPW8lxMvGsqxxNyRozxL3HbzVy
gY0EmRL7ctCY9GHEP0AA6/7iwyUbVPFLYgAMIW+SN2QiR0c9EZuw6Mai7U9WCAHH
kXCpmx7EKG6goa7qmHFsVf3r78mSL7DeWhhoQyGipdUUjS8Un5ilKdemQDbfhsdW
HP9WfeP6t1bBsWOldSuK8SWOzgPxYx7A/3SYaHAFBriNd5ID0EBcR9QE0nT7DO5L
qZunHrkXWtcETlSZlkzZsUmj4AmcnJzb4jRV40fWrp1FdgdL7Q5BiVmtQb/8fElk
NFToSjHR1dmX005bhRAZ
=5ENd
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVi2ClH6ZAP0PgtI9AQKs1g//VBvfVxp1C8V87Q2tpnpI3edeh0843h1P
MafNztd+e88pyXem9LfOR6B8FY8aE2doPFPRkNduHm9XlE2j2ETPRhmM+99HbvGh
sVBmOLKTkPtIn/xbhBqDjADPiSsu3x78P2hHubkJZPOhaV3it782mZVeYzGXdOYL
V4xmBTnhFqLDBYjudtydZe8J6hMvIjoukywtiMaLGwhSJgaPD2tEZNpcdaeLHYze
RKTw4IY2xtjFKWcZ5jOd3UKhzn/K9/pM+r/r4t4sR2kTwnxK4htrRAapUdh8wMV6
ufViwSDjpzmC42SVtHtLvV3ZMA/26igCC92WyuGQI8Q1iYSWMPmUIT5W6lq2sBGp
6QmS835qIT1MFetwNNk/k/BX1GvUhQw9EjzfMjaD+uHmmYFtt3QPAI6dFJwBEAUu
ELVNvHKhlWLnMK29noVC0ZIFB+OaR2hc6Xvf7KgW80mzmnkYv490PlPgizX0horn
bpAAlvKEdg+YAOh+2odRAG815oQp4E6e2ultZY6DsvD1nHXe7dqXHkE6NrBE3qly
F+CRpPKO1xh7HUlgcY7eAc8gccEvIJ4oQ1jvWKKudyb7NLj7iIjg298MUp1za0b+
Jp3Mmu4a5ZwWJ6U1sqSag1o61ebuieV/ObCdB9qL8ucKK2uYVpa3o2lA4nsY4TSu
UlBAA8gOlAg=
=UJLS
-----END PGP SIGNATURE-----