Readymedia Minidlna
Monthly
Stack-based buffer overflow in ReadyMedia (formerly MiniDLNA) 1.3.0 through 1.3.3 allows remote attackers to corrupt stack memory by dropping a crafted DFF audio file with an oversized PROP chunk size into a directory the DLNA server monitors, where an inotify watcher parses it automatically with no user interaction. The oversized value is used without validation to size a variable-length stack array and then to read file data into it, giving remote code execution on builds lacking stack protections and denial of service (crash) on hardened builds. Write access to a monitored media path is the practical prerequisite, which is why the assessed vector is PR:L rather than unauthenticated; a public PoC reference exists, but it is not verified as working exploit code, and no confirmed active exploitation has been reported.
Stack-based buffer overflow in ReadyMedia (formerly MiniDLNA) 1.3.0 through 1.3.3 allows remote attackers to corrupt stack memory by dropping a crafted DFF audio file with an oversized PROP chunk size into a directory the DLNA server monitors, where an inotify watcher parses it automatically with no user interaction. The oversized value is used without validation to size a variable-length stack array and then to read file data into it, giving remote code execution on builds lacking stack protections and denial of service (crash) on hardened builds. Write access to a monitored media path is the practical prerequisite, which is why the assessed vector is PR:L rather than unauthenticated; a public PoC reference exists, but it is not verified as working exploit code, and no confirmed active exploitation has been reported.