UPnP vulnerability a security issues

Rusli

Please refer to this link for details.

 

http://www.f-secure.com/weblog/archives/00002492.html

 

http://news.cnet.com/8301-1009_3-57566366-83/upnp-networking-flaw-puts-millions-of-pcs-at-risk/

 

http://www.theregister.co.uk/2013/01/29/hdmoore_upnp_flaw_rapid7/

Rusli

This is a serious issues.

 

Please take note:- http://www.us-cert.gov/current/#cert_releases_upnp_security_advisory

 

CERT Releases UPnP Security Advisory

added Tuesday, January 29, 2013 at 4:46 pm                

Multiple vulnerabilities have been announced in libupnp, the open source portable SDK for UPnP devices. Libupnp is employed by hundreds of vendors for UPnP-enabled devices. Information is also available in CERT Vulnerability Note VU#922681.
US-CERT recommends that affected UPnP device vendors and developers obtain and employ libupnp version 1.6.18, which addresses these vulnerabilities.
US-CERT recommends that users and administrators review CERT Vulnerability Note VU#922681, disable UPnP (if possible), and restrict access to SSDP (1900/udp) and Simple Object Access Protocol (SOAP) services from untrusted networks such as the Internet

 

This is very important please read:-

 

http://www.kb.cert.org/vuls/id/922681

 

 

Rusli

To check if your routers or computers are affected with uPnP security vulneralbility please goto www.grc.com and select sheild up.

 

There is an option for you to check for uPnP (Universal Plug and Play) security vulnerability.

siramic

Thanks for these warings you posted, (update flash thread also) Rusli, and for the follow up grc test, it's appreciated