RE: libupnp buffer overflows

[<fabrice.fontaine () orange com>]

You can find the list of source code commits for the 1.6.16 here: 
http://pupnp.git.sourceforge.net/git/gitweb.cgi?p=pupnp/pupnp;a=log;h=01d7c05fb882bb1904f5022a33eef8a68d8b8bdc.

Moreover, the most important bug fixes have been added in the tracker: 
http://sourceforge.net/tracker/?atid=841026&group_id=166957&func=browse.

To sum up, most of the issues were about memory leaks 
(http://sourceforge.net/tracker/?func=detail&aid=3497009&group_id=166957&atid=841026), a few of them were about 
security like an out of bound access 
(http://sourceforge.net/tracker/?func=detail&aid=3496933&group_id=166957&atid=841026, classified as CWE-119 by 
Coverity). However, most of the other "security" changes have been made to:
        - replace strcpy or sprint by strncpy or snprintf as using sprintf is seen as a defect by coverity (CWE-676)
        - remove implicit integer conversion between unsigned and signed (seen as CWE-681 by Coverity)

Best Regards,

Fabrice

-----Message d'origine-----
De : Henri Salo [mailto:henri () nerv fi] 
Envoyé : samedi 19 mai 2012 20:47
À : Touko Korpela
Cc : FONTAINE Fabrice RD-MAPS-REN; oss-security () lists openwall com
Objet : Re: libupnp buffer overflows

On Fri, May 18, 2012 at 10:22:52PM +0300, Touko Korpela wrote:
> On Fri, May 18, 2012 at 08:43:52PM +0200, Florian Weimer wrote:
> > * Touko Korpela:
> >
> > > Upstream changelog for libupnp (/usr/share/doc/libupnp6/changelog.gz) lists
> > > many fixes for buffer overflows in version 1.6.16. Should this be added to
> > > tracker and check if CVE number is allocated?
> >
> > It seems that the list of issues is fairly long.  Have you got a list
> > of source code commits?
>
> Unfortunately, no. I only noticed this from the changelog.
> Maybe maintainer and/or upstream can tell if this can be exploited.

Fabrice replied: 
"""
Those issues were found by Coverity (http://www.coverity.com). Coverity affects CWE identifiers like CWE-170 but I 
haven't kept the CWE identifiers of all the fixed bugs.
"""

Did you Fabrice verify if these had security impact? I can try to help if needed.

- Henri Salo