Bug 905820

Summary: US-CERT Vulnerability Note VU#922681 - Libupnp must be updated to ver. 1.6.18
Product: [Fedora] Fedora Reporter: TheDuke <thedukevip>
Component: libupnpAssignee: Adam Jackson <ajax>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 18CC: ajax, mcepl, mcepl
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: All   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-01-30 15:20:03 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description TheDuke 2013-01-30 08:55:48 UTC 
Description of problem:
note taken from US-CERT.gov website:
"Multiple vulnerabilities have been announced in libupnp, the open source portable SDK for UPnP devices. Libupnp is employed by hundreds of vendors for UPnP-enabled devices. Information is also available in CERT Vulnerability Note VU#922681.

US-CERT recommends that affected UPnP device vendors and developers obtain and employ libupnp version 1.6.18, which addresses these vulnerabilities.

US-CERT recommends that users and administrators review CERT Vulnerability Note VU#922681, disable UPnP (if possible), and restrict access to SSDP (1900/udp) and Simple Object Access Protocol (SOAP) services from untrusted networks such as the Internet."
source: http://www.us-cert.gov/current/#cert_releases_upnp_security_advisory

So, libupnp needs to be updated to the latest version (1.6.18)

Version-Release number of selected component (if applicable):
1.6.17

How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 Vincent Danen 2013-01-30 15:20:03 UTC 

*** This bug has been marked as a duplicate of bug 905577 ***