Security Update for minissdpd
Summary
DLA-454-1: minissdpd - security update. Affects minissdpd versions < 1.1.20120121-1+deb7u1. Fixed in 1.1.20120121-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
minissdpd is a daemon that provides network service discovery using the Simple Service Discovery Protocol (SSDP). It allows devices on a network to discover and communicate with each other. The daemon listens for requests on a Unix socket at /var/run/minissdpd.sock. This vulnerability affects minissdpd version 1.1.20120121-1+deb7u1 on Debian 7 Wheezy.
Vulnerability Detail
The minissdpd daemon is vulnerable to an improper validation of array index vulnerability (CWE-129). When processing requests sent to the Unix socket, an unprivileged user can send an invalid request that causes an out-of-bounds memory access, leading to a crash of the minissdpd daemon. This vulnerability can potentially be exploited to execute arbitrary code or cause a denial-of-service condition.
How To Fix
Minimum fixed version
1.1.20120121-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade minissdpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to apply the security update as soon as possible.
Conclusion
The minissdpd daemon is vulnerable to an array index validation issue that can lead to a crash or potential code execution. It is crucial to update to minissdpd version 1.1.20120121-1+deb7u1 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for minissdpd →
FAQ
minissdpd is a daemon that provides network service discovery using the Simple Service Discovery Protocol (SSDP). It allows devices on a network to discover and communicate with each other.
This vulnerability can potentially be exploited to execute arbitrary code or cause a denial-of-service condition.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the playground will analyze it for vulnerabilities.
There is no known workaround for this vulnerability. It is strongly advised to apply the security update as soon as possible.
To update minissdpd, you can run the following commands:
sudo apt-get update sudo apt-get upgrade minissdpd
Related vulnerabilities
Recent vulnerabilities recorded for minissdpd.
