UPNP: NOTIFY Request Denial of Service

This signature detects attempts to exploit a known vulnerability against the UPNP service for Microsoft Windows XP. Attackers can send a malicious NOTIFY request that forces the UPNP daemon to connect to a malicious CHARGEN-like service on the sending host (the attacker's machine); thereby causing a denial-of-service condition by allowing the UPNP daemon to consume all available memory and CPU resources.

Extended Description

Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to cause a denial of service via (1) a spoofed SSDP advertisement that causes the client to connect to a service on another machine that generates a large amount of traffic (e.g., chargen), or (2) via a spoofed SSDP announcement to broadcast or multicast addresses, which could cause all UPnP clients to send traffic to a single target system.

Affected Products

Microsoft windows_98

Short Name
DOS:UPNP-CHARGEN-DOS
Severity
Minor
Recommended
False
Recommended Action
Drop
Category
DOS
Keywords
CA-2001-37 CVE-2001-0877 Denial NOTIFY Request Service bid:3724 of
Release Date
04/22/2003
Supported Platforms

srx-branch-12.3

srx-19.3

srx-branch-19.3

vsrx3bsd-19.2

srx-branch-19.4

vsrx-19.4

mx-12.3

mx-19.4

vmx-19.4

mx-19.3

vsrx3bsd-19.4

srx-19.4

vsrx-12.3

vmx-19.3

vsrx-19.2

srx-12.3

Sigpack Version
3761
Port
TCP/1900
False Positive
Unknown
Vendors

Microsoft

CVSS Score

5.0

Found a potential security threat?