CVE-2015-6031

What it actually does

Buffer overflow in the IGDstartelt XML parsing function allows a remote UPnP server to write beyond allocated memory, resulting in application crash or potential arbitrary code execution.

Why it matters to the business

Systems relying on the MiniUPnP client for network discovery may experience sudden crashes, loss of UPnP functionality, or full host compromise when interacting with malicious or compromised UPnP devices on the network.

How an attack unfolds

An attacker hosts or compromises a UPnP server that responds to discovery requests with an XML document containing an oversized element name, triggering the overflow during parsing in the vulnerable client library.

How to fix it

Upgrade the MiniUPnP client library to version 1.9.20150917 or later; rebuild and redeploy any applications statically or dynamically linking the vulnerable library; replace or isolate affected devices that bundle unpatchable copies.

How to confirm the fix worked

Inventory all binaries and packages using the miniupnpc library, verify reported version is 1.9.20150917 or newer, and test that UPnP discovery completes without crashes against both legitimate and large-element-name test servers.

Typical attack path

1. Attacker places a malicious UPnP server on the same network or reachable via multicast
2. Vulnerable MiniUPnP client sends a discovery request or receives an unsolicited advertisement
3. Server returns a crafted XML response with an oversized element name
4. Client parses the response in IGDstartelt and overflows the buffer
5. Resulting crash or code execution occurs on the client host

How to detect it

Search process crash logs and core dumps for miniupnpc or IGDstartelt symbols, inspect network captures for UPnP responses containing unusually long XML element names, and review application logs for sudden termination during UPnP discovery.

• IGDstartelt
• miniupnpc
• oversized XML element name in SSDP/UPnP responses

What your security team should do

• Immediately identify and patch all instances of miniupnpc older than 1.9.20150917 across Linux distributions and embedded products
• Disable UPnP client functionality where not required
• Monitor network for unexpected UPnP traffic and application crashes in processes using the library
• Apply vendor updates for Debian, Ubuntu, openSUSE, and other affected distributions as they become available