Bug 727170 – <net-libs/libupnp-1.14.0: Denial of service via crafted SSDP message (CVE-2020-13848)

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description Sam James 2020-06-04 21:17:09 UTC]

Description:
"Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c."

[Comment 1 Sam James 2020-06-04 21:17:44 UTC]

@maintainer(s), please apply the provided patch:

https://github.com/pupnp/pupnp/commit/c805c1de1141cb22f74c0d94dd5664bda37398e0

[Comment 2 Sam James 2020-06-27 20:54:59 UTC]

ping

[Comment 3 Sam James 2020-08-20 11:00:41 UTC]

Ping. Please let us know if you're unable to patch this right now.

[Comment 4 Sam James 2020-08-25 23:46:14 UTC]

I guess we will stable..

[Comment 5 Rolf Eike Beer 2020-09-07 18:02:17 UTC]

hppa/sparc stable

[Comment 6 Thomas Deutschmann (RETIRED) 2020-09-07 19:54:31 UTC]

x86 stable

[Comment 7 Sam James 2020-09-07 21:19:38 UTC]

arm done

[Comment 8 Sam James 2020-09-07 21:20:59 UTC]

arm64 done

[Comment 9 ernsteiswuerfel 2020-09-09 17:29:56 UTC]

Looking good on ppc64.

 # cat /mnt/mychroot/root/tatt/libupnp-727170.report 
USE tests started on Di 8. Sep 15:12:12 CEST 2020

FEATURES=' test' USE='' succeeded for =net-libs/libupnp-1.14.0
USE='-blocking-tcp doc ipv6 -reuseaddr -samples -static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp -doc -ipv6 reuseaddr -samples -static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp doc ipv6 reuseaddr -samples -static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='-blocking-tcp -doc -ipv6 -reuseaddr samples -static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='-blocking-tcp -doc ipv6 reuseaddr samples -static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='-blocking-tcp -doc ipv6 -reuseaddr -samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp -doc ipv6 -reuseaddr -samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='-blocking-tcp -doc ipv6 reuseaddr -samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp doc ipv6 reuseaddr -samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='-blocking-tcp -doc -ipv6 -reuseaddr samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp doc -ipv6 -reuseaddr samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='-blocking-tcp doc ipv6 reuseaddr samples static-libs' succeeded for =net-libs/libupnp-1.14.0

revdep tests started on Di 8. Sep 15:29:41 CEST 2020

FEATURES=' test' USE='upnp' succeeded for media-video/vlc
FEATURES=' test' USE='upnp' succeeded for net-p2p/amule

[Comment 10 ernsteiswuerfel 2020-09-09 17:30:16 UTC]

Looking good on ppc.

 # cat libupnp-727170.report 
USE tests started on Mi 9. Sep 17:34:39 CEST 2020

FEATURES=' test' USE='' succeeded for =net-libs/libupnp-1.14.0
USE='-blocking-tcp -doc -ipv6 -reuseaddr -samples -static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp -doc ipv6 -reuseaddr samples -static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp doc ipv6 -reuseaddr samples -static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp -doc ipv6 reuseaddr samples -static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp doc ipv6 reuseaddr samples -static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp doc -ipv6 -reuseaddr -samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp doc ipv6 -reuseaddr -samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp doc -ipv6 reuseaddr -samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp doc ipv6 -reuseaddr samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='-blocking-tcp -doc ipv6 reuseaddr samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp -doc ipv6 reuseaddr samples static-libs' succeeded for =net-libs/libupnp-1.14.0
USE='blocking-tcp doc ipv6 reuseaddr samples static-libs' succeeded for =net-libs/libupnp-1.14.0

revdep tests started on Mi 9. Sep 18:52:20 CEST 2020

FEATURES=' test' USE='upnp' succeeded for media-video/vlc
FEATURES=' test' USE='upnp' succeeded for net-p2p/amule

[Comment 11 Sergei Trofimovich (RETIRED) 2020-09-12 08:07:01 UTC]

ppc/ppc64 stable thanks to ernsteiswuerfel!

[Comment 12 Agostino Sarubbo 2020-09-20 20:22:07 UTC]

amd64 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 13 Larry the Git Cow 2021-03-12 16:27:24 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=33ed7ab218de232aae5e597c3fd24b37e190dd21

commit 33ed7ab218de232aae5e597c3fd24b37e190dd21
Author:     John Helmert III <[e-mail]>
AuthorDate: 2021-03-12 16:26:07 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2021-03-12 16:26:52 +0000

    net-libs/libupnp: security cleanup (drop <1.14.0)
    
    Bug: https://bugs.gentoo.org/727170
    Package-Manager: Portage-3.0.12, Repoman-3.0.2
    Signed-off-by: John Helmert III <[e-mail]>

 net-libs/libupnp/Manifest              |  4 ---
 net-libs/libupnp/libupnp-1.12.1.ebuild | 47 ----------------------------------
 net-libs/libupnp/libupnp-1.6.21.ebuild | 47 ----------------------------------
 net-libs/libupnp/libupnp-1.6.25.ebuild | 47 ----------------------------------
 net-libs/libupnp/libupnp-1.8.7.ebuild  | 47 ----------------------------------
 5 files changed, 192 deletions(-)

[Comment 14 Conrad Kostecki 2021-10-03 13:17:05 UTC]

FYI: I took ownership and bumped to newest 1.14.12