CVE-2020-28926

Vulnerability

ReadyMedia (MiniDLNA) versions prior to 1.3.0 contain a signedness bug in the UPnP HTTP request handler within upnphttp.c. When processing HTTP requests using chunked transfer encoding, the software fails to properly validate the chunk length field. An attacker can specify a large positive value that, when interpreted as a signed integer, becomes negative. This negative length is then passed to memcpy and memmove calls, resulting in a heap buffer overflow [2].

Exploitation

An unauthenticated attacker with network access to the MiniDLNA service can send a crafted UPnP HTTP request using chunked encoding. By setting a chunk length that, when cast to a signed type, becomes negative, the attacker causes the memory copy functions to write beyond the allocated buffer. The Rootshell Security team demonstrated a proof-of-concept exploit that triggers memory corruption and can also cause an infinite loop, leading to denial of service [2].

Impact

Successful exploitation allows remote code execution (RCE) in the context of the MiniDLNA process. Additionally, the same bug can be leveraged to cause a denial-of-service (DoS) condition via an infinite loop. The vulnerability is remotely exploitable without authentication, making it critical for affected deployments [2].

Mitigation

The vendor remediated the issue in version 1.3.0 of ReadyMedia (MiniDLNA). Users should upgrade to 1.3.0 or later. No workarounds are documented; the fix was released following responsible disclosure by Rootshell Security [2].