—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.2121
gupnp security update
15 June 2021
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: gupnp
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Modify Arbitrary Files — Remote with User Interaction
Provide Misleading Information — Remote with User Interaction
Access Confidential Data — Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2021-33516
Reference: ESB-2021.2076
ESB-2021.1879
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:2417
https://access.redhat.com/errata/RHSA-2021:2422
Comment: This bulletin contains two (2) Red Hat security advisories.
– ————————–BEGIN INCLUDED TEXT——————–
– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: gupnp security update
Advisory ID: RHSA-2021:2417-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:2417
Issue date: 2021-06-14
CVE Names: CVE-2021-33516
=====================================================================
1. Summary:
An update for gupnp is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) – x86_64
Red Hat Enterprise Linux Client Optional (v. 7) – noarch, x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) – x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) – noarch, x86_64
Red Hat Enterprise Linux Server (v. 7) – ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) – noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) – x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) – noarch, x86_64
3. Description:
GUPnP is an object-oriented open source framework for creating UPnP devices
and control points, written in C using GObject and libsoup. The GUPnP API
is intended to be easy to use, efficient and flexible.
Security Fix(es):
* gupnp: allows DNS rebinding which could result in tricking browser into
triggering actions against local UPnP services (CVE-2021-33516)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1964091 – CVE-2021-33516 gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services
6. Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
gupnp-1.0.2-6.el7_9.src.rpm
x86_64:
gupnp-1.0.2-6.el7_9.i686.rpm
gupnp-1.0.2-6.el7_9.x86_64.rpm
gupnp-debuginfo-1.0.2-6.el7_9.i686.rpm
gupnp-debuginfo-1.0.2-6.el7_9.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
noarch:
gupnp-docs-1.0.2-6.el7_9.noarch.rpm
x86_64:
gupnp-debuginfo-1.0.2-6.el7_9.i686.rpm
gupnp-debuginfo-1.0.2-6.el7_9.x86_64.rpm
gupnp-devel-1.0.2-6.el7_9.i686.rpm
gupnp-devel-1.0.2-6.el7_9.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
gupnp-1.0.2-6.el7_9.src.rpm
x86_64:
gupnp-1.0.2-6.el7_9.i686.rpm
gupnp-1.0.2-6.el7_9.x86_64.rpm
gupnp-debuginfo-1.0.2-6.el7_9.i686.rpm
gupnp-debuginfo-1.0.2-6.el7_9.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
noarch:
gupnp-docs-1.0.2-6.el7_9.noarch.rpm
x86_64:
gupnp-debuginfo-1.0.2-6.el7_9.i686.rpm
gupnp-debuginfo-1.0.2-6.el7_9.x86_64.rpm
gupnp-devel-1.0.2-6.el7_9.i686.rpm
gupnp-devel-1.0.2-6.el7_9.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
gupnp-1.0.2-6.el7_9.src.rpm
ppc64:
gupnp-1.0.2-6.el7_9.ppc.rpm
gupnp-1.0.2-6.el7_9.ppc64.rpm
gupnp-debuginfo-1.0.2-6.el7_9.ppc.rpm
gupnp-debuginfo-1.0.2-6.el7_9.ppc64.rpm
ppc64le:
gupnp-1.0.2-6.el7_9.ppc64le.rpm
gupnp-debuginfo-1.0.2-6.el7_9.ppc64le.rpm
s390x:
gupnp-1.0.2-6.el7_9.s390.rpm
gupnp-1.0.2-6.el7_9.s390x.rpm
gupnp-debuginfo-1.0.2-6.el7_9.s390.rpm
gupnp-debuginfo-1.0.2-6.el7_9.s390x.rpm
x86_64:
gupnp-1.0.2-6.el7_9.i686.rpm
gupnp-1.0.2-6.el7_9.x86_64.rpm
gupnp-debuginfo-1.0.2-6.el7_9.i686.rpm
gupnp-debuginfo-1.0.2-6.el7_9.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
noarch:
gupnp-docs-1.0.2-6.el7_9.noarch.rpm
ppc64:
gupnp-debuginfo-1.0.2-6.el7_9.ppc.rpm
gupnp-debuginfo-1.0.2-6.el7_9.ppc64.rpm
gupnp-devel-1.0.2-6.el7_9.ppc.rpm
gupnp-devel-1.0.2-6.el7_9.ppc64.rpm
ppc64le:
gupnp-debuginfo-1.0.2-6.el7_9.ppc64le.rpm
gupnp-devel-1.0.2-6.el7_9.ppc64le.rpm
s390x:
gupnp-debuginfo-1.0.2-6.el7_9.s390.rpm
gupnp-debuginfo-1.0.2-6.el7_9.s390x.rpm
gupnp-devel-1.0.2-6.el7_9.s390.rpm
gupnp-devel-1.0.2-6.el7_9.s390x.rpm
x86_64:
gupnp-debuginfo-1.0.2-6.el7_9.i686.rpm
gupnp-debuginfo-1.0.2-6.el7_9.x86_64.rpm
gupnp-devel-1.0.2-6.el7_9.i686.rpm
gupnp-devel-1.0.2-6.el7_9.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
gupnp-1.0.2-6.el7_9.src.rpm
x86_64:
gupnp-1.0.2-6.el7_9.i686.rpm
gupnp-1.0.2-6.el7_9.x86_64.rpm
gupnp-debuginfo-1.0.2-6.el7_9.i686.rpm
gupnp-debuginfo-1.0.2-6.el7_9.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
noarch:
gupnp-docs-1.0.2-6.el7_9.noarch.rpm
x86_64:
gupnp-debuginfo-1.0.2-6.el7_9.i686.rpm
gupnp-debuginfo-1.0.2-6.el7_9.x86_64.rpm
gupnp-devel-1.0.2-6.el7_9.i686.rpm
gupnp-devel-1.0.2-6.el7_9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-33516
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
– —–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBYMfDBtzjgjWX9erEAQh4wA//SuhKPeuUIZWeQkt2mZncTtxzm+gW/IW7
eI0HkcCZ2pAFBHk9RnAOOR4Os3er7+H/jmHpVy/DHzWqzIORZK/2hraQD2+FT7BF
QZvLUKqQVUIe4XM1XTKuaQfJ7ObDnWqzKpML1m+wRcdMZjSnh5FRolB/TY2dCadJ
23RdlurPEqdHfzCscguvOX6IQQB+hzL1yEPCveQZZvAbZfqNzJatHlz1My0XJWh1
GVGeGFZea+D85F5WJXvvPbaMTrEBEgfcUDKZ+bI+YJUVyYzNu9mGlihdP0hh2nSw
BKOyhTbPtDfCrMTlUtpMS0F3KE+yjrWWfKzdTUWiaHkNvTwa55kWz4LY44z8o/FK
7sjZjWy5cTNdurmWgND997u4FnToPGZRc989TifLg44gHMIDzlO/8BKbcMoXTKIz
J1AY+A+POOL8r5BTQX0+tRE1NvxjXCNN1uOA1UshiutM06HhQFJ6wV9v1//1Sj1B
QJFtI+WHRr4Gb6dr32wgxnvN+OjOWeA5uoBfn8EY8KUS3PQny7GzJx//Q7L99rVZ
tRU1WGrKoo8cXFrfCuDdd3j7TlH6POk+qkUDY8eWoUiqAmxKDGZP177sddmOgK7y
4+6g1G40ex5VnTgZr+GB45b2vVIOGZ9e383BNAsL+TcjnWJKUC92fd+LY+eMhgpV
m02U4ORvOnE=
=6QHR
– —–END PGP SIGNATURE—–
– ——————————————————————————–
– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: gupnp security update
Advisory ID: RHSA-2021:2422-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:2422
Issue date: 2021-06-14
CVE Names: CVE-2021-33516
=====================================================================
1. Summary:
An update for gupnp is now available for Red Hat Enterprise Linux 8.2
Extended Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat CodeReady Linux Builder EUS (v. 8.2) – aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux AppStream EUS (v. 8.2) – aarch64, ppc64le, s390x, x86_64
3. Description:
GUPnP is an object-oriented open source framework for creating UPnP devices
and control points, written in C using GObject and libsoup. The GUPnP API
is intended to be easy to use, efficient and flexible.
Security Fix(es):
* gupnp: allows DNS rebinding which could result in tricking browser into
triggering actions against local UPnP services (CVE-2021-33516)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1964091 – CVE-2021-33516 gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services
6. Package List:
Red Hat Enterprise Linux AppStream EUS (v. 8.2):
Source:
gupnp-1.0.3-3.el8_2.src.rpm
aarch64:
gupnp-1.0.3-3.el8_2.aarch64.rpm
gupnp-debuginfo-1.0.3-3.el8_2.aarch64.rpm
gupnp-debugsource-1.0.3-3.el8_2.aarch64.rpm
ppc64le:
gupnp-1.0.3-3.el8_2.ppc64le.rpm
gupnp-debuginfo-1.0.3-3.el8_2.ppc64le.rpm
gupnp-debugsource-1.0.3-3.el8_2.ppc64le.rpm
s390x:
gupnp-1.0.3-3.el8_2.s390x.rpm
gupnp-debuginfo-1.0.3-3.el8_2.s390x.rpm
gupnp-debugsource-1.0.3-3.el8_2.s390x.rpm
x86_64:
gupnp-1.0.3-3.el8_2.i686.rpm
gupnp-1.0.3-3.el8_2.x86_64.rpm
gupnp-debuginfo-1.0.3-3.el8_2.i686.rpm
gupnp-debuginfo-1.0.3-3.el8_2.x86_64.rpm
gupnp-debugsource-1.0.3-3.el8_2.i686.rpm
gupnp-debugsource-1.0.3-3.el8_2.x86_64.rpm
Red Hat CodeReady Linux Builder EUS (v. 8.2):
aarch64:
gupnp-debuginfo-1.0.3-3.el8_2.aarch64.rpm
gupnp-debugsource-1.0.3-3.el8_2.aarch64.rpm
gupnp-devel-1.0.3-3.el8_2.aarch64.rpm
ppc64le:
gupnp-debuginfo-1.0.3-3.el8_2.ppc64le.rpm
gupnp-debugsource-1.0.3-3.el8_2.ppc64le.rpm
gupnp-devel-1.0.3-3.el8_2.ppc64le.rpm
s390x:
gupnp-debuginfo-1.0.3-3.el8_2.s390x.rpm
gupnp-debugsource-1.0.3-3.el8_2.s390x.rpm
gupnp-devel-1.0.3-3.el8_2.s390x.rpm
x86_64:
gupnp-debuginfo-1.0.3-3.el8_2.i686.rpm
gupnp-debuginfo-1.0.3-3.el8_2.x86_64.rpm
gupnp-debugsource-1.0.3-3.el8_2.i686.rpm
gupnp-debugsource-1.0.3-3.el8_2.x86_64.rpm
gupnp-devel-1.0.3-3.el8_2.i686.rpm
gupnp-devel-1.0.3-3.el8_2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-33516
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
– —–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBYMe5T9zjgjWX9erEAQgtvw//V44xnsj2lIHUNrgTyDvm+RZFhZVJA69Q
Lylomb9rGJ1PEwK976cqOzmXqzblxZawUdcjM0hyCgIo8AXfsemj0UFDAYdPHwZJ
oEg7R4WtzkYYsYOvLtgaRLs1ZxwDoxbAPfQ1tvSSdSHhPmc29YeukFNxOx0iaPWq
2+l901cgqr32E8fwmLnLIBnJ1EISvp+D3UoDMYlOp82iTY94Y62vy6Jvai/6PLjr
rQElcoA94EscV6H2iRYXuHu2rJf3P7DwW7hoYCE1XbLtNFcOfzvsc8uNbtXQ2eXF
Est5S79SyFqdJ9IkWgXzFhSmJ6yusecy9LIs42j9U3t3VKyVGSsLe4bYVeehYgfm
dXJv7VNjhVRJ44696UxyNMfFvBXfpVKTG0BpYOD3Hh3hHedXZ3T+gC/V0lcrgyNb
fSyAUyVgMaUv0Rq91dq2zfXDZWQKKYU2Oq6c+rGxGKyYZmJTonOz92vafJDwID5p
Lfkqzo62hTfksxd5z6ZxaK1bFtkPnVr37Cp2wwkFhCcsAVtpTLhrJo+wp8xYz0Ol
GxyVH0iAtdGFhUZELupmPrq1JHtdaw5u0f/XnohncLxrjP9d+PpQ/rU/ZsVgnt12
FfQIGCzUSRcv2FvyVfmXVhPn80XA6n4siu24ohVzcKSJY6tXu2ddcJt9lvhKjjah
9UseKIULouY=
=rT7q
– —–END PGP SIGNATURE—–
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYMfjvONLKJtyKPYoAQjDkhAAg1s1wTPHYZht8sjuxX/AFTqfxHE1V1aY
rkbEWPC7Y3iuwYc2Ba+PwEQRDWBrad00jWGO+ERnNQ459evSP/EAW9EjrUCkr6pB
Hwtocd74L5kjyosLr6CFo7Elo8wIX1f5X4fDeBNmgpr1LNA1t8NYGj3g4j3FLeic
XpcQ5OPrxJ8tgxeLo7zFDezqcJP3CnU13bA9VPV6C/IB2/wmYzKM1H84qDtcvGBO
KCPhA+zYXkiizAOG0zvxXJ2t+rWAUM9zhTyez4FENd+iE/aUyd3MxgfnVLY6Zx4O
3cdBkr8TMwpIcU4ILmcMaoSxsdAOJjx8BHVFeapoMQdwFHejLmgvMVtdEnw01l0C
vCrzaEkO+Dyfu3g1iHsoNrYxwGUht+P8QljZNfk6UPOg248XY5tdE+kr0eftJDsW
9Y3aBkySxC9DvxuvEtb5vhUvZuPmLxQ8KjZBYODj/Z2LO5BRJuDqFNATyPjZeEIw
a58ePqRbK3Z22iF0eJkto6AeL9P4t5ebcPlQhvnWNcnJIzWqdxPEHYsLIbgNXPYD
RmE2FCG9d0vpqiYXRvdRsnurOOtn5jGyaOfAXkiebpHQj35XDLcsEMgT/LJ5CMOj
7XT14bpOudfgu10tArCedPdG0/2SdPOzy0CtC+FnLiN1kYIeQl/r7JdF2KLsPbi5
TOOb2C3UHWA=
=5RPH
—–END PGP SIGNATURE—–
The post ESB-2021.2121 – [RedHat] gupnp: Multiple vulnerabilities appeared first on Malware Devil.
https://malwaredevil.com/2021/06/15/esb-2021-2121-redhat-gupnp-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-2121-redhat-gupnp-multiple-vulnerabilities
No comments:
Post a Comment