Description
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
miniupnp project miniupnpd
Default version status: unaffected
0 to ≤ 2.3.11affected
References
- https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a ↗
- https://github.com/miniupnp/miniupnp ↗
- https://github.com/miniupnp/miniupnp/blob/miniupnpd_2_3_11/miniupnpd/minissdp.c#L1143-L1158 ↗
- https://github.com/miniupnp/miniupnp/blob/miniupnpd_2_3_11/miniupnpd/minissdp.c#L1281 ↗
- https://www.vulncheck.com/advisories/miniupnpd-through-2.3.11-divide-by-zero-dos-via-ssdp-m-search-mx-header ↗