What is all the fuss about?
On Thursday, December 20, 2001 Microsoft revealed that the
hackers at eEye had discovered multiple critical security
flaws in all versions of Windows using Universal Plug and Play:
Quoting from eEye's press release:
"eEye has discovered three vulnerabilities within
Microsoft's UPnP implementation: a remotely exploitable
buffer overflow that allows an attacker gain SYSTEM level
access to any default installation of Windows XP, a Denial
of Service (DoS) attack, and a Distributed Denial of Service
(DDoS) attack. eEye would like to stress the extreme
seriousness of this vulnerability. Network administrators
are urged to immediately install the patch released by
Microsoft at
http://www.microsoft.com/technet/security/bulletin/MS01-059.asp"
"The most serious of the three Windows XP vulnerabilities is
the remotely exploitable buffer overflow. It is possible for
an attacker to write custom exploit code that will allow
them to execute commands with SYSTEM level access, the
highest level of access within Windows XP."
"The other two vulnerabilities are types of denial of
service attacks. The first is a fairly straightforward
denial of service attack, which allows an attacker to
remotely crash any Windows XP system. The crash will require
Windows XP users to physically power down their machines and
start them up again before the system will function. The
second denial of service attack is a distributed denial of
service attack. This vulnerability allows attackers to
remotely command many Windows XP systems at once in an
effort to make them flood/attack a single host."