Vulnerability Note VU#347812

UPnP enabled by default in multiple devices

Multiple vendors ship devices with UPnP enabled by default. These devices may be configured to only listen for UPnP requests on local networks or wireless interfaces. By using browser plugins that execute in the context of the local system, an attacker may be able to send UPnP messages to local devices without authentication. One researcher has demonstrated an attack vector that uses the Adobe Flash plugin.

Note that to successfully exploit this vulnerability an attacker would need to be able to guess the IP address of an affected device. This IP address may also be enumerated through browser headers or other methods.

II. Impact

Adobe has issued an update that prevents Flash from being used as an attack vector to exploit this vulnerability.

From the Understanding Flash Player 9 April 2008 Security Update compatibility document:

The April 2008 Flash Player update adds a new security feature to perform a cross-domain policy file check before allowing SWFs to send headers to another domain. This change helps improve web site security by helping to defend against malicious HTTP headers sent by content from other domains. The feature will also help to mitigate a potential UPnP issue (VU#347812) in which routers fail to correctly handle unexpected header values.

• UPnP should be disabled on devices that are being use to enforce security policies or are connected to untrusted networks, such as the Internet. 
• Filtering the IGMP protocol between LAN segments may prevent UPnP devices from connecting to networks that they are not authorized to access.

• Disabling UPnP on network devices will mitigate this vulnerability. Note that disabling UPnP will cause any devices or applications that rely on UPnP to fail or operate with reduced functionality.
• Disabling UPnP in desktop operating systems may prevent an attacker from exploiting this vulnerability. Microsoft Windows XP users should see the workarounds section of Microsoft Security Bulletin MS07-019 for instructions on how to disable UPnP.
• Using the Mozilla Firefox NoScript extension to whitelist web sites that can run scripts and access installed plugins may prevent this vulnerability from being exploited.
• Using host-based firewalls to filter ports 1900/udp and 2869/tcp both inbound and outbound may prevent this vulnerability from being exploited by blocking the ports that UPnP uses. Note that the Windows Vista firewall blocks UPnP by default. This workaround may not be able to prevent exploitation of this vulnerability.

http://www.upnp.org/
http://www.upnp.org/download/UPnP_Vendor_Implementation_Guide_Jan2001.htm
http://www.upnp.org/membership/members.asp
http://www.gnucitizen.org/blog/hacking-the-interwebs
http://www.kb.cert.org/vuls/id/347812
http://windowshelp.microsoft.com/Windows/en-US/Help/32f3845b-eda0-4168-be8d-90f07250d8101033.mspx
http://www.microsoft.com/technet/security/Bulletin/MS07-019.mspx
http://www.us-cert.gov/reading_room/securing_browser/
http://noscript.net/features#contentblocking
http://linux-igd.sourceforge.net/
http://www.shorewall.net/UPnP.html

Credit

Information about this vulnerability was released by PDP on the GNUCITIZEN website.

This document was written by Ryan Giobbi.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.