Vulnerability Note VU#347812

UPnP enabled by default in multiple devices

Original Release date: 15 Jan 2008 | Last revised: 22 Jul 2008

Overview

Multiple vendors ship devices with UPnP enabled by default. By convincing a user to open a malicious URL, an attacker may be able to remotely control or configure UPnP enabled devices.

Description

Universal Plug and Play (UPnP) is a collection of protocols maintained and distributed by the UPnP Forum. UPnP is designed to allow network devices to easily connect to each other. UPnP enabled applications may be able to control other UPnP enabled devices such as firewalls or routers automatically and without authentication. Some applications may rely on UPnP to automatically open ports on routers or automatically set other parameters on compatible devices.

Multiple vendors ship devices with UPnP enabled by default. These devices may be configured to only listen for UPnP requests on local networks or wireless interfaces. By using browser plugins that execute in the context of the local system, an attacker may be able to send UPnP messages to local devices without authentication. One researcher has demonstrated an attack vector that uses the Adobe Flash plugin.

Note that to successfully exploit this vulnerability an attacker would need to be able to guess the IP address of an affected device. This IP address may also be enumerated through browser headers or other methods.

Impact

By convincing a victim to click on a link in an HTML document (web page, HTML email), an attacker could issue any command or change any configuration that can be set via UPnP on an affected device. If the affected device is providing routing or firewalling services to clients, an attacker may be able to change firewall and port forwarding rules, modify DNS settings, change wireless encryption keys, or set arbitrary administration passwords.

Solution

We are currently unaware of a practical solution to this problem. Developers using UPnP should see the UPnP forum's vendor statement for more information.

Adobe has issued an update that prevents Flash from being used as an attack vector to exploit this vulnerability.

From the Understanding Flash Player 9 April 2008 Security Update compatibility document:

    The April 2008 Flash Player update adds a new security feature to perform a cross-domain policy file check before allowing SWFs to send headers to another domain. This change helps improve web site security by helping to defend against malicious HTTP headers sent by content from other domains. The feature will also help to mitigate a potential UPnP issue (VU#347812) in which routers fail to correctly handle unexpected header values.

Workarounds for administrators
  • UPnP should be disabled on devices that are being use to enforce security policies or are connected to untrusted networks, such as the Internet. 
  • Filtering the IGMP protocol between LAN segments may prevent UPnP devices from connecting to networks that they are not authorized to access.
Workarounds for users
  • Disabling UPnP on network devices will mitigate this vulnerability. Note that disabling UPnP will cause any devices or applications that rely on UPnP to fail or operate with reduced functionality.
  • Disabling UPnP in desktop operating systems may prevent an attacker from exploiting this vulnerability. Microsoft Windows XP users should see the workarounds section of Microsoft Security Bulletin MS07-019 for instructions on how to disable UPnP.
  • Using the Mozilla Firefox NoScript extension to whitelist web sites that can run scripts and access installed plugins may prevent this vulnerability from being exploited.
  • Using host-based firewalls to filter ports 1900/udp and 2869/tcp both inbound and outbound may prevent this vulnerability from being exploited by blocking the ports that UPnP uses. Note that the Windows Vista firewall blocks UPnP by default. This workaround may not be able to prevent exploitation of this vulnerability.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
NEC CorporationAffected15 Jan 200830 Jun 2008
Foundry Networks, Inc.Not Affected15 Jan 200830 Jan 2008
Internet Security Systems, Inc.Not Affected15 Jan 200830 Jan 2008
IntotoNot Affected15 Jan 200830 Jan 2008
McAfeeNot Affected15 Jan 200821 Jan 2008
Network Appliance, Inc.Not Affected15 Jan 200830 Jan 2008
SnortNot Affected15 Jan 200821 Jan 2008
SourcefireNot Affected15 Jan 200821 Jan 2008
TippingPoint, Technologies, Inc.Not Affected15 Jan 200816 Jan 2008
3com, Inc.Unknown15 Jan 200815 Jan 2008
AdobeUnknown09 Apr 200809 Apr 2008
AlcatelUnknown15 Jan 200815 Jan 2008
Apple Computer, Inc.Unknown15 Jan 200815 Jan 2008
AT&TUnknown15 Jan 200815 Jan 2008
Avaya, Inc.Unknown15 Jan 200815 Jan 2008
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Information about this vulnerability was released by PDP on the GNUCITIZEN website.

This document was written by Ryan Giobbi.

Other Information

  • CVE IDs: Unknown
  • Date Public: 15 Jan 2008
  • Date First Published: 15 Jan 2008
  • Date Last Updated: 22 Jul 2008
  • Severity Metric: 18.43
  • Document Revision: 60

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.