Another Exploit:- Universal Plug & Play and ICS

[Matty_Cross]

Microsoft today issued a critical recommendation
regarding Windows, Windows XP, or ME machines that share internet
connections with Windows 98/98SE clients.
This is in relation to a unchecked buffer in Universal Plug & Play.


View the technet article here

[micael]

Originally posted by Matty Cross
Microsoft today issued a critical recommendation
regarding Windows, Windows XP, or ME machines that share internet
connections with Windows 98/98SE clients.
This is in relation to a unchecked buffer in Universal Plug & Play.

View the technet article here

Thanks for great information Matty !

Acknowledgments
Microsoft thanks eEye Digital Security (http://www.eeye.com) for reporting this issue to us and working with us to protect customers.

I got a newsflash from eEye describing the security flaw above. I can't quote the original text since I need their aproval and I don't have time to get their permission. But I can advice everybody to read the full article at eEye since it contains some information not provided by microsoft. You can find the article here.

[Matty_Cross]

Some more News...

'WIN-XP HOLE' MISREPRESENTED | News: SecurityFocus
The real Windows XP vulnerability, according to this commentary, has
been misrepresented as a Universal Plug-and-Play flaw, but the real
problem is in XP's Simple Service Discovery Protocol (SSDP) service.
The SSDP vulnerability arises when specially formatted notify
datagrams are created that can be used to exploit a buffer overrun to
gain system access, or perform DoS or DDoS attacks.

Read More
Here