Documentation
 
  Discovery
  Messaging
  Eventing
  Rmi
  Jmx
  Security
 
  Built with Apache Forrest logo Financial help logo
 
Designed for Firefox logo 


by SuperBonBon  PDF 

UPNP™ security



Security problems  > Devices security 

Security problems

Some security problems have been found with some UPNP™ implementations ( guess who :o) ). Most of the security flaws are implementation independant and do not concern UPNPLib. However a DDOS attack can be acheived due to a protocol flaw. UPNPLib has been developped to do not allow ( or at least limit ) such kind of attacks. You can read more about it here. The official MS bug report is here and the security bulletin from the company that discovered the issue.

UPNPLib is not concerned with these flaws, future will tell if UPNPLib other security issues will be found.

Devices security

Another problem with UPNP™ is that there is no protocol built-in ACL to define who can access and send orders to UPNP™ devices.

UPNP™ forum came with a solution to fix this issue but unfortunatly we did not find devices compliant with this spec to integrate this ACL and security layer in the library. We hope we will be able to do it anytime soon with some other tools.

This means that this library will not work with devices implementing and using such security services.


 

Copyright © 2005 SuperBonBon Industries. All rights reserved.
Unless otherwise expressly noted, the contents of these pages are licensed under the Creative Commons - Attribution / Share Alike license.