Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 18 Jul 2016 20:53:51 +0200
From: Hanno Böck <>
Subject: libupnp write files via POST


Wanted to point out this report by Matthew Garret (not sure if there's
anything else than a couple of tweets public):

"Reported this to upstream 8 months ago without response, so: libupnp's
default behaviour allows anyone to write to your filesystem"
"Seriously. Find a device running a libupnp based server (Shodan says
there's rather a lot), and POST a file to /testfile. Then GET /testfile"
"…and yeah if the server is running as root (it is) and is using / as
the web root (probably not, but maybe) this gives full host fs access"

And later on:
"Emailed the Debian security team a couple of months ago, no response"

Not good...


Hanno Böck


Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.