Bug 270998 - net/minidlna: update to avoid bug introduced <= 1.3.2
Summary: net/minidlna: update to avoid bug introduced <= 1.3.2
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Gleb Smirnoff
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-04-22 11:44 UTC by Thomas Guymer
Modified: 2024-01-24 18:06 UTC (History)
0 users

See Also:
bugzilla: maintainer-feedback? (glebius)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Guymer 2023-04-22 11:44:13 UTC 
Hi,

The web interface no longer works if connecting via example.com:8200 due to an overzealous DNS rebinding attack check recently introduced in MiniDLNA. Connecting via 1.2.3.4:8200 still works fine though. There is a good discussion of the issue over on the Debian bug system: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011629 This bug is also reported upstream over on SourceForge: https://sourceforge.net/p/minidlna/bugs/346/ I can confirm that on my FreeBSD system my /var/log/minidlna.log file contains a:

[2023/04/22 12:28:23] upnphttp.c:938: error: DNS rebinding attack suspected (Host: example.com:8200)

... line when I try to connect via a web browser using the hostname, but it works fine if I cheat and explicitly connect using the server's IPv4 address. The Debian bug indicates that the issue is fixed, however, the SourceForge ticket is still open, so I don't know the status of the upstream patch.

Thanks,

Tom
Comment 1 commit-hook freebsd_committer freebsd_triage 2024-01-24 18:06:05 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=a19e3a5b5f1eb1c8bf3b6bc7d0e0d08530053940

commit a19e3a5b5f1eb1c8bf3b6bc7d0e0d08530053940
Author:     Gleb Smirnoff <glebius@FreeBSD.org>
AuthorDate: 2024-01-24 18:04:49 +0000
Commit:     Gleb Smirnoff <glebius@FreeBSD.org>
CommitDate: 2024-01-24 18:05:38 +0000

    net/minidlna: update to 1.3.3

    PR:             270998

 net/minidlna/Makefile | 3 +--
 net/minidlna/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)