Welcome!

Open Source Cloud Authors: Liz McMillan, Pat Romanski, Yeshim Deniz, Elizabeth White, Zakia Bouachraoui

News Feed Item

UPnP Forum Responds to Recently Identified LibUPnP/MiniUPnP Security Flaw

BEAVERTON, OR -- (Marketwire) -- 02/08/13 -- UPnP Forum -- the global standards body that has paved the way for seamless connectivity between more than a billion devices -- today responds to concerns over a security flaw identified by Rapid7 in the open source, third party libraries 'libupnp' hosted at SourceForge and MiniUPnP hosted at miniupnp.free.fr.

On January 29th, UPnP Forum members received the public news that Rapid7 has identified a security flaw in the open source, 3rd party stacks libupnp and MiniUPnP. Based on Rapid7's white paper, the flaw is only in the implementation of old versions of libupnp (older than 1.6.18) and MiniUPNP (older than 1.4). The flaws are NOT associated with the UPnP specifications themselves or UPnP Forum's certification process for UPnP stacks. In addition, the flaws outlined by Rapid 7 show an implementation responding to UPnP protocols on the WAN ports of routers that existing UPnP standards are not designed for. Existing UPnP protocols are only intended for LAN usage that is not forwarded on to the internet.

The UPnP Forum is encouraging all vendors using open source implementations of protocol stacks to ensure they are using the latest releases and are active in ensuring that the security of those stacks is maintained. In the case of the libupnp and MiniUPnP, the UPnP Forum has posted a message to its website to help consumers and vendors identify the problem in this third party software. Please note that other issues have been identified in the latest version of MiniUPnP, 1.4, but they won't be publicly disclosed until the library's developer releases a patch to address them, so we advise caution on any further usage of this stack until such time. We are also looking into test tool enhancements that can identify implementations coming for certification that continue to use this flawed older versions of UPnP stacks. Numerous other closed and open source stacks exist in the UPnP ecosystem to use as alternatives if you have remaining concerns over libupnp or MiniUPNP.

For gateway vendors both affected and unaffected by this identified flaw, the UPnP Forum continues to advise that vendors implement the latest version of the Internet Gateway Device (v2) rather than the V1 that is deployed today. Along with our Device Protection standard, this specification provides numerous enhancements for security as well as necessary enhancements like the growing deployment of IPv6.

For further information about UPnP Forum please go to www.upnp.org. For general questions, please e-mail [email protected].

About UPnP Forum
UPnP Forum, established in 1999, is a global alliance of more than 950 industry-leading organizations working to enable device-to-device interoperability and facilitate easier and better home networking. The Forum promotes the adoption of uniform technical device interconnectivity standards and certifies devices conforming to these standards. UPnP Forum is an impartial group enabling member companies to participate and develop extensions to the UPnP Device Architecture, which defines how to use the Internet Protocol (IP) to communicate between devices, and Device Control Protocols (DCPs), which are services between devices. Members of UPnP Forum include market leaders in computing, printing and networking, consumer electronics, home appliances, automation, control and security, and mobile products.

For media enquiries please contact:
Dana Corson
Proactive PR
Email Contact
Tel: +44 1636812152
Mobile: +44 7795 615466

More Stories By Marketwired .

Copyright © 2009 Marketwired. All rights reserved. All the news releases provided by Marketwired are copyrighted. Any forms of copying other than an individual user's personal reference without express written permission is prohibited. Further distribution of these materials is strictly forbidden, including but not limited to, posting, emailing, faxing, archiving in a public database, redistributing via a computer network or in a printed form.

IoT & Smart Cities Stories
SYS-CON Events announced today that DatacenterDynamics has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY. DatacenterDynamics is a brand of DCD Group, a global B2B media and publishing company that develops products to help senior professionals in the world's most ICT dependent organizations make risk-based infrastructure and capacity decisions.
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time t...
Cloud-enabled transformation has evolved from cost saving measure to business innovation strategy -- one that combines the cloud with cognitive capabilities to drive market disruption. Learn how you can achieve the insight and agility you need to gain a competitive advantage. Industry-acclaimed CTO and cloud expert, Shankar Kalyana presents. Only the most exceptional IBMers are appointed with the rare distinction of IBM Fellow, the highest technical honor in the company. Shankar has also receive...
A valuable conference experience generates new contacts, sales leads, potential strategic partners and potential investors; helps gather competitive intelligence and even provides inspiration for new products and services. Conference Guru works with conference organizers to pass great deals to great conferences, helping you discover new conferences and increase your return on investment.
Headquartered in Plainsboro, NJ, Synametrics Technologies has provided IT professionals and computer systems developers since 1997. Based on the success of their initial product offerings (WinSQL and DeltaCopy), the company continues to create and hone innovative products that help its customers get more from their computer applications, databases and infrastructure. To date, over one million users around the world have chosen Synametrics solutions to help power their accelerated business or per...
DXWorldEXPO LLC announced today that ICOHOLDER named "Media Sponsor" of Miami Blockchain Event by FinTechEXPO. ICOHOLDER gives detailed information and help the community to invest in the trusty projects. Miami Blockchain Event by FinTechEXPO has opened its Call for Papers. The two-day event will present 20 top Blockchain experts. All speaking inquiries which covers the following information can be submitted by email to [email protected] Miami Blockchain Event by FinTechEXPOalso offers sp...
SYS-CON Events announced today that IoT Global Network has been named “Media Sponsor” of SYS-CON's @ThingsExpo, which will take place on June 6–8, 2017, at the Javits Center in New York City, NY. The IoT Global Network is a platform where you can connect with industry experts and network across the IoT community to build the successful IoT business of the future.
IoT is rapidly becoming mainstream as more and more investments are made into the platforms and technology. As this movement continues to expand and gain momentum it creates a massive wall of noise that can be difficult to sift through. Unfortunately, this inevitably makes IoT less approachable for people to get started with and can hamper efforts to integrate this key technology into your own portfolio. There are so many connected products already in place today with many hundreds more on the h...