Databarracks recognised for second consecutiv... » London-based provider Databarracks has been recognised in Gartner’s June 2016 Magic Quadrant for Dis... INSURERS OFFER BETTER DEAL FOR ARMED FORCES PERS... » Armed Forces personnel posted overseas will from today (Saturday 25 June) be able to keep their moto... Qognify wins Government Security News’ 2016 Airpor... » Qognify, formerly NICE Security has announced that it has been awarded three Government Security New... NSI launches Powered Gates Certification Sche... » The National Security Inspectorate (NSI) has announced today the launch of its ground-breaking Power... Royal Engineers present Blesma with a cheque for... » Earlier this month, Blesma’s Chief Executive (and former Royal Engineer) Barry Le Grys, Associate Di... Wireless lock technology opens the door to new a... » Axis Communications will be demonstrating its AXIS A1001 Network Door Controller, alongside ASSA ABL... Celebrating National Women in Engineering Day: Eng... » As a nation, Britain has a knack for producing and harbouring engineering talent. Throughout history... UEFA European Championship apps may violate Brin... » Maidenhead, U.K: With EURO 2016 in full swing, football fans around the world are watching 24 teams ... MBDA and DCI team up in capacity-based training » Paris: Défense Conseil International (DCI) and MBDA France have signed a Memorandum of Understanding... CMI Defence and Ricardo together for the UK ‘Cha... » Belgian weapons systems designer, manufacturer and integrator CMI Defence, and Ricardo UK Ltd, have ...

CLICK HERE TO

Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.

READ MORE

Subscribe to Vigilance Weekly

Information Security Header

Beaverton, Ore., USA: UPnP Forum – the global standards body that has paved the way for seamless connectivity between more than a billion devices – today responds to concerns over a security flaw identified by Rapid7 in the open source, third party libraries ‘libupnp’ hosted at SourceForge and MiniUPnP hosted at miniupnp.free.fr.

 

On January 29th, UPnP Forum members received the public news that Rapid7 has identified a security flaw in the open source, 3rd party stacks libupnp and MiniUPnP. Based on Rapid7’s white paper, the flaw is only in the implementation of old versions of libupnp (older than 1.6.18) and MiniUPNP (older than 1.4). The flaws are NOT associated with the UPnP specifications themselves or UPnP Forum’s certification process for UPnP stacks. In addition, the flaws outlined by Rapid 7 show an implementation responding to UPnP protocols on the WAN ports of routers that existing UPnP standards are not designed for. Existing UPnP protocols are only intended for LAN usage that is not forwarded on to the internet.

The UPnP Forum is encouraging all vendors using open source implementations of protocol stacks to ensure they are using the latest releases and are active in ensuring that the security of those stacks is maintained. In the case of the libupnp and MiniUPnP, the UPnP Forum has posted a message to its website to help consumers and vendors identify the problem in this third party software. Please note that other issues have been identified in the latest version of MiniUPnP, 1.4, but they won't be publicly disclosed until the library's developer releases a patch to address them, so we advise caution on any further usage of this stack until such time. We are also looking into test tool enhancements that can identify implementations coming for certification that continue to use this flawed older versions of UPnP stacks. Numerous other closed and open source stacks exist in the UPnP ecosystem to use as alternatives if you have remaining concerns over libupnp or MiniUPNP.

For gateway vendors both affected and unaffected by this identified flaw, the UPnP Forum continues to advise that vendors implement the latest version of the Internet Gateway Device (v2) rather than the V1 that is deployed today. Along with our Device Protection standard, this specification provides numerous enhancements for security as well as necessary enhancements like the growing deployment of IPv6