Bug 1270841 (CVE-2015-6031)

Summary:	CVE-2015-6031 miniupnpc: Buffer overflow vulnerability in XML parser functionality
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	carnil, domingobecker, paulo.cesar.pereira.de.andrade
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 02:44:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1270842
Bug Blocks:

Description Adam Mariš 2015-10-12 13:50:26 UTC

A buffer overflow vulnerability was found in the XML parser functionality of MiniUPnP library. A specially crafted XML response can lead to a buffer overflow on the stack resulting in remote code execution. An attacker can set up a server on the local network to trigger this vulnerability. Buffer overflow is present in client-side, miniupnpc, part of the library. Vulnerable part of the code is triggered when applications using miniupnpc library are doing initial network discovery upon startup, while parsing the replies from UPNP servers on the local network. Buffer overflow is triggered by an oversized XML element name.

More info can be found here:

http://talosintel.com/reports/TALOS-2015-0035/

Comment 1 Adam Mariš 2015-10-12 13:50:53 UTC

Created miniupnpc tracking bugs for this issue:

Affects: fedora-all [bug 1270842]

Comment 3 Adam Mariš 2015-10-22 09:11:16 UTC

Upstream patch:

https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78

Comment 4 Product Security DevOps Team 2019-06-08 02:44:00 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.