DoS vulnerability found in Windows XP

A flaw in the Universal Plug and Play (UPnP) facility in Microsoft's Windows XP could enable a hacker to launch a denial of service attack.

UPnP is a Microsoft-backed industry standard which uses web protocols and allows PCs, printers and wireless devices plugged into a network to automatically communicate with each other.

On Windows XP systems each UPnP request uses memory that is not being freed up because of a memory leak error.

A hacker could manipulate the error by exhausting the system's memory resources via repeatedly sending invalid UPnP data to the target system. The flaw also affects Windows 98 and ME systems.

Microsoft has been forced to issue a warning and a patch is now available, although the risk is classified as low.

Standard firewall practices, such as blocking ports 1900 and 5000, and activating the Windows XP default firewall would impede an attacker's ability to locate and attack the system.

The Microsoft advisory on this bug can be found here.