Summary
It was discovered that ReadyMedia (MiniDLNA) allowed subscription requests with
a delivery URL on a different network segment than the fully qualified event-
subscription URL. An attacker could use this to hijack smart devices and cause
denial of service attacks. (CVE-2020-12695)
It was discovered that ReadyMedia (MiniDLNA) allowed remote code execution.
A remote attacker could send a malicious UPnP HTTP request to the service
using HTTP chunked encoding and cause a denial of service.
(CVE-2020-28926)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | minidlna | 1.1.5+dfsg-2ubuntu0.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | minidlna | 1.2.1+dfsg-1ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | minidlna | 1.2.1+dfsg-1ubuntu0.20.04.1 |
Vulnerabilities 2
-
Unscored —
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription …
-
Unscored —
ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to …