Are any PN routers vulnerable to the 'new' UPnP exploit?

[#1]

Are any PN routers vulnerable to the 'new' UPnP exploit?
http://news.google.co.uk/news?q=Security+Flaws+in+Universal+Plug+and+Play
https://community.rapid7.com/docs/DOC-2150
https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf  (1.1 Mb)
https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-...

This paper is the result of a research project spanning the second half of 2012 that measured the global exposure of UPnP-enabled network devices. The results were shocking to the say the least. Over 80 million unique IPs were identified that responded to UPnP discovery requests from the internet. Somewhere between 40 and 50 million IPs are vulnerable to at least one of three attacks outlined in this paper. The two most commonly used UPnP software libraries both contained remotely exploitable vulnerabilities. In the case of the Portable UPnP SDK, over 23 million IPs are vulnerable to remote code execution through a single UDP packet. All told, we were able to identify over 6,900 product versions that were vulnerable through UPnP. This list encompasses over 1,500 vendors and only took into account devices that exposed the UPnP SOAP service to the internet, a serious vulnerability in of itself.
The vulnerabilities we identified in the Portable UPnP SDK have been fixed as of version 1.6.18 (released today), but it will take a long time before each of the application and device vendors incorporate this patch into their products. In most cases, network equipment that is "no longer shipping" will not be updated at all, exposing these users to remote compromise until UPnP is disabled or the product is swapped for something new. The flaws identified in the MiniUPnP software were fixed over two years ago, yet over 330 products are still using older versions.
[...]
Portable SDK for UPnP Devices unique_service_name() Buffer Overflows
The libupnp library, originally known as the Intel SDK for UPnP Devices and now maintained as the Portable SDK for UPnP Devices, is vulnerable to multiple stack-based buffer overflows when handling malicious SSDP requests. This library is used by tens of millions of deployed network devices, of which approximately twenty million are exposed directly to the internet. In addition to network devices, many streaming media and file sharing applications are also exposed to attack through this library.
This advisory does not address historic or current vulnerabilities in the HTTP and SOAP processing code of libupnp.
Affected Versions
Versions 1.2 (Intel SDK) and 1.2.1a - 1.8.0 (Portable SDK) are affected by at least three remotely exploitable buffer overflows in the unique_service_name() function, which is called to process incoming SSDP requests on UDP port 1900. Additionally, versions prior to 1.6.17 are vulnerable to additional issues in the same function. Please see Appendix A for a review of the vulnerable code by version.
Affected Vendors
Hundreds of vendors have used the libupnp library in their products, many of which are acting as the home routers for consumer networks. Any application linking to libupnp is likely to be affected and a list of confirmed vendors and products is provided in Appendix B.

(N.B. The two scan tools available at Rapid7.com suck: one requires the Java JRE, and the non-java browser-based version doesn't work for me.)

[#2]

"40-50 million network-enabled devices are at risk"
Your more likely to win the lottery then you are to be hacked with this exploit. At the end of the day just turn off UPnP on the router and forward ports manually. I mean thats all its used for right?

[#3]

Given that UPNP allows any program (including viruses and trojans) to instruct the firewall to open ports into your network,  the recommendation from most people with any security knowledge is to disable it.

[#4]

Quote from: Blim

"40-50 million network-enabled devices are at risk" Your more likely to win the lottery then you are to be hacked with this exploit.

The lottery happens once a week. If it takes a single UDP packet to exploit this vulnerability, then how long would it take to (attempt to) hack all 50 million devices? Well, the Sapphire worm (also using a single malicious UDP packet) took maybe 10 minutes :-

Quote

By passively monitoring traffic (either by sniffing or sampling packets or monitoring firewall logs) on a set of links providing connectivity to multiple networks, each responsible for about 65,000 IP addresses, we were able to infer the worms overall scanning behavior over time. Sapphire reached its peak scanning rate of over 55 million scans per second across the Internet in under 3 minutes. At this rate, the worm would effectively scan over 90 percent of the entire Internet in a little more than 10 minutes.

Presumably actual 0-day exploits of this hole would be (are being?) smarter and slower. But still, if your router accepts UPnP requests over its WAN interface, I'd guess the chances of eventually being subjected to an attempted hack by this exploit are approaching 100%.
Do, say, some Technicolor routers do that? It looks like they used to, at least :-

Quote

Technicolor Information for VU#357851 Overview Some Internet router devices incorrectly accept UPnP requests over the WAN interface. Description Universal Plug and Play (UPnP) is a networking protocol mostly used for personal computing devices to discover and communicate with each other and the Internet. Some UPnP enabled router devices incorrectly accept UPnP requests over the WAN interface. "AddPortMapping" and "DeletePortMapping" actions are accepted on these devices. These requests can be used to connect to internal hosts behind a NAT firewall and also proxy connections through the device and back out to the Internet. Date Updated: 07 Oct 2011 Status Affected Vendor Statement No statement is currently available from the vendor regarding this vulnerability. Vendor Information Thomson and Speedtouch brands have been assimilated into the Technicolor company and brand.

I presume all current PN routers are fine. Be nice to have that positively affirmed though.

Quote from: kmilburn

Given that UPNP allows any program (including viruses and trojans) to instruct the firewall to open ports into your network,  the recommendation from most people with any security knowledge is to disable it.

Sure. And don't let the kids, or visitors, turn it back on accidentally. And don't forget to turn it back off if you do a factory reset, or a firmware update.
But that's all a slightly different point than whether our routers have actual UPnP flaws which are worse than just the default configuration.

[#5]

Our routers are not affected as severely as those provided by other vendors.
Our routers do not expose their uPnP interface to the Internet, meaning that any attack must come from inside your LAN. However I've not been able to find out if the router's even suffer from this vulnerability at all.
In short, you are safe, do not worry. I'll update this thread later when I've spoken to Technicolor.
Thanks,
Matt

[#6]

A quick update. You can check this your own device using the web tool at:
http://upnp-check.rapid7.com and using the downloadable tool here: http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.js...
It shows that the TG582n I've got on my desk is not vulnerable however this is only one device and Technicolor have multiple uPnP stacks on different devices.
I'm waiting on a statement from Technicolor and I'll pass that on as soon as I get it.

[#7]

My Netgear DG834G v4 isn't vulnerable according to that check

[#8]

Nor my TP-Link WR2543ND! 

[#9]

Quote from: Matt

Our routers do not expose their uPnP interface to the Internet, meaning that any attack must come from inside your LAN. However I've not been able to find out if the router's even suffer from this vulnerability at all. In short, you are safe, do not worry. I'll update this thread later when I've spoken to Technicolor.

Thanks Matt. I know you'll want to check for older PlusNet-supplied routers too (I was using your SpeedTouch ST516 until just a couple of months ago, for example).

Quote from: Matt

A quick update. You can check this your own device using the web tool at: http://upnp-check.rapid7.com and using the downloadable tool here: http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.js...

Thanks. The downloadable tool requires Java, which many people avoid as a security precaution, ironically. And the online tool has problems too: if you use the non-SSL link, you may just be scanning a transparent proxy; and if you add an 's' to the URL you have to ignore your browser warnings and trust an incorrect SSL certificate. Either way they don't display the IP which was scanned, so you can't be sure the displayed results are really for your router.
Here's a better one : https://www.grc.com/x/ne.dll?bh0bkyd2
Here are sample results, in case you want to look before testing  :-
https://www.grc.com/su/UPnP-Exposed.htm
https://www.grc.com/su/UPnP-Rejected.htm
https://www.grc.com/su/UPnP-NoResponse.htm
My Technicolor TG582n passed :).

[#10]

My Netgear N300 passes all them as well. A shields up full scan (first 1034) shows all green, but fails for ping - needed for the ping graphs 

[#11]

passed the grc one as well

[#12]

A quick update from our supplier, Technicolor:

Quote

Our security team have reviewed the recent UPnP vulnerability scare highlighted earlier this week on the Register (etc) and our DSL products are NOT vulnerable to attack in their default configuration. An official statement is currently being reviewed for release.

[#13]

Passed the GRC uPnP test too! 

[#14]

AC66U passed the test

[#15]

Which checker? Dynamic or Static?