Reported November 1, 2001, by Microsoft.
All systems running Microsoft’s
Universal Plug and Play, including:
- Microsoft Windows XP
- Microsoft Windows Me
Windows 98 and 98SE
A vulnerability exists in Microsoft Universal Plug and Play (UPnP) service that can cause a Denial of Service (DoS) condition. Because the UPnP service doesn't correctly handle invalid requests or multiple connections exceeding 1017, an attacker can use the vulnerability to create a DoS condition. The UPnP service is not enabled by default, but an attacker can enable it through the OEM channels. Microsoft recommends that users block ports 1900 and 5000 with a firewall.
vendor, Microsoft, has released security
to address this vulnerability and recommends that affected users apply the
appropriate patch provided at one of the URLs given in the bulletin.
Discovered by Ken of Franklin Tech Unlimited.