Bug 2336676 (CVE-2024-51442) - CVE-2024-51442 minidlna: command injection via specially crafted minidlna.conf file [NEEDINFO]
Summary: CVE-2024-51442 minidlna: command injection via specially crafted minidlna.con...
Keywords:
Status: NEW
Alias: CVE-2024-51442
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2336839 2336840 2336841
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-01-09 17:45 UTC by OSIDB Bzimport
Modified: 2025-01-11 21:46 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:
dominik: needinfo? (rgatica)

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-01-09 17:45:36 UTC 
Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna.conf configuration file.
Comment 2 Dominik 'Rathann' Mierzejewski 2025-01-11 21:46:37 UTC 
What is this, a joke? If you can modify /etc/minidlna.conf, you have root on the system already:

$ ls -ld /etc/minidlna.conf 
-rw-r--r--. 1 root root 4374 May 28  2024 /etc/minidlna.conf

This seems to be the upstream "report":
https://sourceforge.net/p/minidlna/bugs/364/

And "proof of concept":
https://github.com/mselbrede/CVE-2024-51442
Note You need to log in before you can comment on or make changes to this bug.