BSD Portsminiupnpd -- Integer underflow in SOAPAction header parsing
An integer underflow in the SOAPAction header parsing in ParseHttpHeaders() lets a remote attacker trigger an out-of-bounds read by sending a malformed SOAPAction header containing a single quote. This can crash miniupnpd or disclose memory beyond the HTTP request buffer.
Affected versions
- miniupnpd < 2.3.10,1
By system
0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | net/miniupnpd | 2.3.11,1 | fixed | |
| OpenBSD | net/miniupnp/miniupnpd | 2.3.8 | in range, by version | |
| NetBSD | net/miniupnpd | 2.1 | not listed |