Date: Sat, 29 Dec 2001 11:29:48 -0000 From: "John Cooper" <[EMAIL PROTECTED]> Subject: RE: [LIB] Re: Windows XP - Am I the first SECURITY WARNING
This is the info you need! Unchecked Buffer in UPnP can Lead to System Compromise Microsoft strongly urges all Windows XP customers to apply the patch immediately. Customers using Windows 98, 98SE, or ME should apply the patch if the Universal Plug and Play service is installed and running. The Universal Plug and Play (UPnP) service allows computers to discover and use network-based devices. Windows ME and XP include native UPnP services; Windows 98 and 98SE do not include a native UPnP service, but one can be installed via the Internet Connection Sharing client that ships with Windows XP. This bulletin discusses two vulnerabilities affecting these UPnP implementations. Although the vulnerabilities are unrelated, both involve how UPnP-capable computers handle the discovery of new devices on the network. The first vulnerability is a buffer overrun vulnerability. There is an unchecked buffer in one of the components that handle NOTIFY directives - messages that advertise the availability of UPnP-capable devices on the network. By sending a specially malformed NOTIFY directive, it would be possible for an attacker to cause code to run in the context of the UPnP service, which runs with System privileges on Windows XP. (On Windows 98 and Windows ME, all code executes as part of the operating system). This would enable the attacker to gain complete control over the system. The second vulnerability results because the UPnP doesn't sufficiently limit the steps to which the UPnP service will go to obtain information on using a newly discovered device. Within the NOTIFY directive that a new UPnP device sends is information telling interested computers where to obtain its device description, which lists the services the device offers and instructions for using them. By design, the device description may reside on a third-party server rather than on the device itself. However, the UPnP implementations don't adequately regulate how it performs this operation, and this gives rise to two different denial of service scenarios. In the first scenario, the attacker could send a NOTIFY directive to a UPnP-capable computer, specifying that the device description should be downloaded from a particular port on a particular server. If the server was configured to simply echo the download requests back to the UPnP service (e.g., by having the echo service running on the port that the computer was directed to), the computer could be made to enter an endless download cycle that could consume some or all of the system's availability. An attacker could craft and send this directive to a victim's machine directly, by using the machine's IP address. Or, he could send this same directive to a broadcast and multicast domain and attack all affected machines within earshot, consuming some or all of those systems' availability. In the second scenario, an attacker could specify a third-party server as the host for the device description in the NOTIFY directive. If enough machines responded to the directive, it could have the effect of flooding the third-party server with bogus requests, in a distributed denial of service attack. As with the first scenario, an attacker could either send the directives to the victim directly, or to a broadcast or multicast domain. Patch availability Download locations for this patch Microsoft Windows 98/98SE: http://www.windowsupdate.com or http://www.microsoft.com/Downloads/Release.asp?ReleaseID=34991 Microsoft Windows ME: http://www.windowsupdate.com or http://download.microsoft.com/download/winme/Update/22940/WinMe/EN-US/31 4757USAM.EXE Microsoft Windows XP: http://www.windowsupdate.com or http://www.microsoft.com/Downloads/Release.asp?ReleaseID=34951 -----Original Message----- From: Matthew Hanson [mailto:[EMAIL PROTECTED]] Sent: 29 December 2001 06:38 To: Libretto Subject: Re: [LIB] Re: Windows XP - Am I the first Date: Sat, 29 Dec 2001 06:32:12 +0000 From: "Matthew Hanson" <[EMAIL PROTECTED]> Subject: Re: [LIB] Re: Windows XP - Am I the first >Date: Fri, 28 Dec 2001 19:54:23 -0000 >From: "George Derby" <[EMAIL PROTECTED]> > >Just to let you know that I have successfully installed XP in a Libretto >110CT - no problems at all - a lot faster than Windows 98 and a lovely >desktop. I have also done this on my 'big' laptop and this, too, was easy. I'm guessing you know about - and have patched the security whole in XP that's big enough to shove the state of Texas through. Buffer overrun... and/or PnP something.... Matt _________________________________________________________________ Join the world's largest e-mail service with MSN Hotmail. http://www.hotmail.com ************************************************************** http://libretto.basiclink.com - Libretto mailing list http://libretto.basiclink.com/archive - Archives http://www.picante.com/~gtaylor/portable/faq.html - FAQ -------TO UNSUBSCRIBE------- Reply to any of the list messages. The reply mail should be addressed to: [EMAIL PROTECTED] - Then replace any text on the message's subject line: cmd:unsubscribe --------TO UNSUBSCRIBE DIGEST------ Do above but with this on subject line: cmd:unsubscribe digest ************************************************************** ************************************************************** http://libretto.basiclink.com - Libretto mailing list http://libretto.basiclink.com/archive - Archives http://www.picante.com/~gtaylor/portable/faq.html - FAQ -------TO UNSUBSCRIBE------- Reply to any of the list messages. The reply mail should be addressed to: [EMAIL PROTECTED] - Then replace any text on the message's subject line: cmd:unsubscribe --------TO UNSUBSCRIBE DIGEST------ Do above but with this on subject line: cmd:unsubscribe digest **************************************************************
