Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title UPnP enabled by default in multiple devices
Informations
Name VU#347812 First vendor Publication 2008-01-15
Vendor VU-CERT Last vendor Modification 2008-01-31
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#347812

UPnP enabled by default in multiple devices

Overview

Multiple vendors ship devices with UPnP enabled by default. By convincing a user to open a malicious URL, an attacker may be able to remotely control or configure UPnP enabled devices.

I. Description

Universal Plug and Play (UPnP) is a collection of protocols maintained and distributed by the UPnP Forum. UPnP is designed to allow network devices to easily connect to each other. UPnP enabled applications may be able to control other UPnP enabled devices such as firewalls or routers automatically and without authentication. Some applications may rely on UPnP to automatically open ports on routers or automatically set other parameters on compatible devices.

Multiple vendors ship devices with UPnP enabled by default. These devices may be configured to only listen for UPnP requests on local networks or wireless interfaces. By using browser plugins that execute in the context of the local system, an attacker may be able to send UPnP messages to local devices without authentication. One researcher has demonstrated an attack vector that uses the Adobe Flash plugin.

Note that to successfully exploit this vulnerability an attacker would need to be able to guess the IP address of an affected device. This IP address may also be enumerated through browser headers or other methods.

II. Impact

By convincing a victim to click on a link in an HTML document (web page, HTML email), an attacker could issue any command or change any configuration that can be set via UPnP on an affected device. If the affected device is providing routing or firewalling services to clients, an attacker may be able to change firewall and port forwarding rules, modify DNS settings, change wireless encryption keys, or set arbitrary administration passwords.

III. Solution

We are currently unaware of a practical solution to this problem.

Workarounds for administrators

  • UPnP should be disabled on devices that are being use to enforce security policies or are connected to untrusted networks, such as the Internet. 
  • Filtering the IGMP protocol between LAN segments may prevent UPnP devices from connecting to networks that they are not authorized to access.
Workarounds for users
  • Disabling UPnP on network devices will mitigate this vulnerability. Note that disabling UPnP will cause any devices or applications that rely on UPnP to fail or operate with reduced functionality.
  • Disabling UPnP in desktop operating systems may prevent an attacker from exploiting this vulnerability. Microsoft Windows XP users should see the workarounds section of Microsoft Security Bulletin MS07-019 for instructions on how to disable UPnP.
  • Using the Mozilla Firefox NoScript extension to whitelist web sites that can run scripts and access installed plugins may prevent this vulnerability from being exploited.
  • Using host-based firewalls to filter ports 1900/udp and 2869/tcp both inbound and outbound may prevent this vulnerability from being exploited by blocking the ports that UPnP uses. Note that the Windows Vista firewall blocks UPnP by default. This workaround may not be able to prevent exploitation of this vulnerability.

Systems Affected

VendorStatusDate Updated
3com, Inc.Unknown15-Jan-2008
AlcatelUnknown15-Jan-2008
Apple Computer, Inc.Unknown15-Jan-2008
AT&TUnknown15-Jan-2008
Avaya, Inc.Unknown15-Jan-2008
Avici Systems, Inc.Unknown15-Jan-2008
Borderware TechnologiesUnknown15-Jan-2008
BroUnknown15-Jan-2008
CentOSUnknown15-Jan-2008
Charlotte's Web NetworksUnknown15-Jan-2008
Check Point Software TechnologiesUnknown15-Jan-2008
Cisco Systems, Inc.Unknown15-Jan-2008
ClavisterUnknown15-Jan-2008
Computer AssociatesUnknown15-Jan-2008
Computer Associates eTrust Security ManagementUnknown15-Jan-2008
Conectiva Inc.Unknown15-Jan-2008
Cray Inc.Unknown15-Jan-2008
D-Link Systems, Inc.Unknown15-Jan-2008
Data Connection, Ltd.Unknown15-Jan-2008
Debian GNU/LinuxUnknown15-Jan-2008
EMC CorporationUnknown15-Jan-2008
Engarde Secure LinuxUnknown15-Jan-2008
Enterasys NetworksUnknown15-Jan-2008
EricssonUnknown15-Jan-2008
eSoft, Inc.Unknown15-Jan-2008
Extreme NetworksUnknown15-Jan-2008
F5 Networks, Inc.Unknown15-Jan-2008
Fedora ProjectUnknown15-Jan-2008
Force10 Networks, Inc.Unknown15-Jan-2008
Fortinet, Inc.Unknown15-Jan-2008
Foundry Networks, Inc.Not Vulnerable30-Jan-2008
FreeBSD, Inc.Unknown15-Jan-2008
FujitsuUnknown15-Jan-2008
Gentoo LinuxUnknown15-Jan-2008
Global Technology AssociatesUnknown15-Jan-2008
Hewlett-Packard CompanyUnknown15-Jan-2008
HitachiUnknown15-Jan-2008
HyperchipUnknown15-Jan-2008
IBM CorporationUnknown15-Jan-2008
IBM Corporation (zseries)Unknown15-Jan-2008
IBM eServerUnknown15-Jan-2008
Ingrian Networks, Inc.Unknown15-Jan-2008
Intel CorporationUnknown15-Jan-2008
Internet Security Systems, Inc.Not Vulnerable30-Jan-2008
IntotoNot Vulnerable30-Jan-2008
IP FilterUnknown15-Jan-2008
Juniper Networks, Inc.Unknown15-Jan-2008
Linksys (A division of Cisco Systems)Unknown15-Jan-2008
Lucent TechnologiesUnknown15-Jan-2008
Luminous NetworksUnknown15-Jan-2008
m0n0wallUnknown15-Jan-2008
Mandriva, Inc.Unknown15-Jan-2008
McAfeeNot Vulnerable21-Jan-2008
Microsoft CorporationUnknown15-Jan-2008
MontaVista Software, Inc.Unknown15-Jan-2008
Multinet (owned Process Software Corporation)Unknown15-Jan-2008
Multitech, Inc.Unknown15-Jan-2008
NEC CorporationUnknown15-Jan-2008
NetBSDUnknown15-Jan-2008
netfilterUnknown15-Jan-2008
Netgear, Inc.Unknown15-Jan-2008
Network Appliance, Inc.Not Vulnerable30-Jan-2008
NextHop Technologies, Inc.Unknown15-Jan-2008
NokiaUnknown15-Jan-2008
Nortel Networks, Inc.Unknown15-Jan-2008
Novell, Inc.Unknown15-Jan-2008
OpenBSDUnknown15-Jan-2008
Openwall GNU/*/LinuxUnknown16-Jan-2008
QNX, Software Systems, Inc.Unknown15-Jan-2008
RadWare, Inc.Unknown15-Jan-2008
Red Hat, Inc.Unknown15-Jan-2008
Redback Networks, Inc.Unknown15-Jan-2008
Riverstone Networks, Inc.Unknown15-Jan-2008
Secure Computing Network Security DivisionUnknown15-Jan-2008
Secureworx, Inc.Unknown15-Jan-2008
Silicon Graphics, Inc.Unknown15-Jan-2008
Slackware Linux Inc.Unknown15-Jan-2008
SmoothWallUnknown15-Jan-2008
SnortNot Vulnerable21-Jan-2008
Sony CorporationUnknown15-Jan-2008
SourcefireNot Vulnerable21-Jan-2008
StonesoftUnknown15-Jan-2008
Sun Microsystems, Inc.Unknown15-Jan-2008
SUSE LinuxUnknown15-Jan-2008
Symantec, Inc.Unknown15-Jan-2008
The SCO GroupUnknown15-Jan-2008
TippingPoint, Technologies, Inc.Not Vulnerable16-Jan-2008
Trustix Secure LinuxUnknown15-Jan-2008
TurbolinuxUnknown15-Jan-2008
UbuntuUnknown15-Jan-2008
UnisysUnknown15-Jan-2008
Watchguard Technologies, Inc.Unknown15-Jan-2008
Wind River Systems, Inc.Unknown15-Jan-2008
ZyXELUnknown15-Jan-2008

References


http://www.upnp.org/
http://www.upnp.org/download/UPnP_Vendor_Implementation_Guide_Jan2001.htm
http://www.upnp.org/membership/members.asp
http://www.gnucitizen.org/blog/hacking-the-interwebs
http://windowshelp.microsoft.com/Windows/en-US/Help/32f3845b-eda0-4168-be8d-90f07250d8101033.mspx
http://www.microsoft.com/technet/security/Bulletin/MS07-019.mspx
http://www.us-cert.gov/reading_room/securing_browser/
http://noscript.net/features#contentblocking
http://linux-igd.sourceforge.net/
http://www.shorewall.net/UPnP.html

Credit

Information about this vulnerability was released by PDP on the GNUCITIZEN website.

This document was written by Ryan Giobbi.

Other Information

Date Public01/15/2008
Date First Published01/15/2008 01:47:51 PM
Date Last Updated01/31/2008
CERT Advisory 
CVE Name 
US-CERT Technical Alerts 
Metric9.83
Document Revision54

Original Source

Url : http://www.kb.cert.org/vuls/id/347812

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-352 Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11435
 
Oval ID: oval:org.mitre.oval:def:11435
Title: Interaction error between Adobe Flash and multiple Universal Plug and Play (UPnP) services allow remote attackers to perform Cross-Site Request Forgery (CSRF) style attacks by using the Flash navigateToURL function to send a SOAP message to a UPnP control point, as demonstrated by changing the primary DNS server.
Description: Interaction error between Adobe Flash and multiple Universal Plug and Play (UPnP) services allow remote attackers to perform Cross-Site Request Forgery (CSRF) style attacks by using the Flash navigateToURL function to send a SOAP message to a UPnP control point, as demonstrated by changing the primary DNS server.
Family: windows Class: vulnerability
Reference(s): CVE-2008-1654
 Version: 5
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2012
 Product(s): Adobe Flash Player
Adobe AIR
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

OpenVAS Exploits

Date Description
2010-05-12 Name : Mac OS X 10.5.3 Update / Mac OS X Security Update 2008-003
File : nvt/macosx_upd_10_5_3_secupd_2008-003.nasl
2009-11-17 Name : Mac OS X Version
File : nvt/macosx_version.nasl
2009-01-23 Name : SuSE Update for flash-player SUSE-SA:2008:022
File : nvt/gb_suse_2008_022.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200804-21 (netscape-flash)
File : nvt/glsa_200804_21.nasl
2008-09-03 Name : Adobe Flash Player 9.0.115.0 and earlier vulnerability (Lin)
File : nvt/flash_player_CB-A08-0059.nasl
2008-09-03 Name : Adobe Flash Player 9.0.115.0 and earlier vulnerability (Win)
File : nvt/smbcl_flash_player_CB-A08-0059.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
44279 Adobe Flash UPnP navigateToURL Function SOAP Message CSRF

Nessus® Vulnerability Scanner

Date Description
2009-08-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-0221.nasl - Type : ACT_GATHER_INFO
2008-05-29 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_10_5_3.nasl - Type : ACT_GATHER_INFO
2008-05-29 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2008-003.nasl - Type : ACT_GATHER_INFO
2008-04-22 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200804-21.nasl - Type : ACT_GATHER_INFO
2008-04-17 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_flash-player-5159.nasl - Type : ACT_GATHER_INFO
2008-04-17 Name : The remote openSUSE host is missing a security update.
File : suse_flash-player-5161.nasl - Type : ACT_GATHER_INFO
2008-04-10 Name : The remote Windows host contains a browser plugin that is affected by multipl...
File : flash_player_apsb08-11.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2013-05-11 00:57:02
  • Multiple Updates