ReadyMedia (MiniDLNA) DFF parser stack buffer overflow allows remote code execution
Planting a bad music file in your home media server's folder can let attackers take over it.
Summary
A stack buffer overflow in the ReadyMedia (MiniDLNA) DFF audio parser lets a remote attacker run code by planting a crafted file in a monitored folder. Versions 1.3.0 through 1.3.3 are affected, and builds with stack protections only suffer a denial of service.
Affected when
- inotify automatic folder monitoring enabled (inotify = yes)
- build without stack protections
What to do
Check that the running version is newer than 1.3.3, and read the vendor's advisory (such as ASUS) and install its firmware update. Versions below 1.3.0 are not affected.
Products and platforms
CVE IDs
Sources
- Write-up: kr3bz.wtf (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen