Security firm predicts UPnP exploit by the end of the week

BOFFINS AT IBM SECURITY FIRM ISS scratched their crystal balls and announced that a vulnerability in Microsoft Windows' Universal Plug and Play (UPnP) technology would be exploited by the end of the week.

"We are taking this flaw very seriously and expect to see an exploit by the end of the week," said Tom Cross, X-Force researcher at IBM Internet Security Systems. He added that since the UPnP service is not universally enabled in the corporate environment, "it is unlikely that this flaw will result in a worm like Zotob".

He urged organisations to download the patch from Microsoft "as soon as possible".

Not particularly helpful, you may think since he'd just said that most corporates wouldn't have UPnP enabled. The INQ urges end users who have the technology enabled to download the patch too.

Especially since ISS reckons the flaw in the UPnP service is "easy to exploit, providing an attacker with complete control over the victim PC".

Microsoft yesterday issued a bunch of band aids for its holey software here. µ