Multiple vendors ship devices with UPnP enabled by default. By convincing a user to open a malicious URL, an attacker may be able to remotely control or configure UPnP enabled devices.
Universal Plug and Play (UPnP) is a collection of protocols maintained and distributed by the UPnP Forum. UPnP is designed to allow network devices to easily connect to each other. UPnP enabled applications may be able to control other UPnP enabled devices such as firewalls or routers automatically and without authentication. Some applications may rely on UPnP to automatically open ports on routers or automatically set other parameters on compatible devices.
Multiple vendors ship devices with UPnP enabled by default. These devices may be configured to only listen for UPnP requests on local networks or wireless interfaces. By using browser plugins that execute in the context of the local system, an attacker may be able to send UPnP messages to local devices without authentication. One researcher has demonstrated an attack vector that uses the Adobe Flash plugin.
By convincing a victim to click on a link in an HTML document (web page, HTML email), an attacker could issue any command or change any configuration that can be set via UPnP on an affected device. If the affected device is providing routing or firewalling services to clients, an attacker may be able to change firewall and port forwarding rules, modify DNS settings, change wireless encryption keys, or set arbitrary administration passwords.
We are currently unaware of a practical solution to this problem. Developers using UPnP should see the UPnP forum's vendor statement for more information.
Adobe has issued an update that prevents Flash from being used as an attack vector to exploit this vulnerability.
Foundry Networks, Inc.
Internet Security Systems, Inc.
Network Appliance, Inc.
TippingPoint, Technologies, Inc.
Apple Computer, Inc.
Avici Systems, Inc.
Charlotte's Web Networks
Check Point Software Technologies
Cisco Systems, Inc.
Computer Associates eTrust Security Management
D-Link Systems, Inc.
Data Connection, Ltd.
Engarde Secure Linux
F5 Networks, Inc.
Force10 Networks, Inc.
Global Technology Associates
IBM Corporation (zseries)
Ingrian Networks, Inc.
Juniper Networks, Inc.
Linksys (A division of Cisco Systems)
MontaVista Software, Inc.
Multinet (owned Process Software Corporation)
NextHop Technologies, Inc.
Nortel Networks, Inc.
QNX, Software Systems, Inc.
Red Hat, Inc.
Redback Networks, Inc.
Riverstone Networks, Inc.
Secure Computing Network Security Division
Silicon Graphics, Inc.
Slackware Linux Inc.
Sun Microsystems, Inc.
The SCO Group
Trustix Secure Linux
Watchguard Technologies, Inc.
Wind River Systems, Inc.
Information about this vulnerability was released by PDP on the GNUCITIZEN website.
This document was written by Ryan Giobbi.
|Date First Published:||2008-01-15|
|Date Last Updated:||2008-07-22 14:45 UTC|