Article ID: 311311
Article Last Modified on 9/26/2005
APPLIES TO
- Microsoft Windows Millennium Edition
This article was previously published under Q311311
For additional information on how this vulnerability affects Windows XP, Windows 98, and Windows 98 Second Edition, click the article number below to view the article in the Microsoft Knowledge Base:
309073 Invalid Universal Plug and Play Request can Disrupt System Operation
SYMPTOMS
By sending a particular set of commands to an affected Windows Millennium Edition (Me) computer, an attacker could cause a variety of effects, from slowing the computer's performance to causing it to fail altogether. For example, you may receive either of the following error messages on a computer that is running Windows Me with the Universal Plug and Play driver installed:
On Windows Me, the affected component is available as part of the operating system, but it is not installed by default. However, some hardware manufacturers do install it on the systems they sell.
CAUSE
This vulnerability results because the Universal Plug and Play service that either is included with, or can be installed on, Windows Me does not correctly process certain requests. In Windows Me, these requests can cause an access violation error message and result in the computer failing.
RESOLUTION
A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that you determine are at risk of attack. Evaluate your computer's physical accessibility, network and Internet connectivity, and other factors to determine the degree of risk to your computer. See the associated Microsoft Security Bulletin to help determine the degree of risk. This fix may receive additional testing. If your computer is sufficiently at risk, Microsoft recommends that you apply this fix now.
To resolve this problem immediately, download the fix by clicking the download link later in this article or contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, please visit the following Microsoft Web site:
NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled, if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.
The following file is available for download from the Microsoft Download Center:
US English: ![[GRAPHIC: Download]](/wiki/index.php?title=File:Download.gif){kind=small}
Download 311311usam.exe now
Czech:Download 311311czem.exe now
Chinese: Download 311311chsm.exe now
Dutch: Download 311311dutm.exe now
Danish: Download 311311danm.exe now
Enabled Arabic: Download 311311earm.exe now
Enabled Hebrew: Download 311311ehem.exe now
Finnish: Download 311311finm.exe now
French: Download 311311frnm.exe now
German: Download 311311germ.exe now
Greek: Download 311311grkm.exe now
Hungarian: Download 311311hunm.exe now
Italian: Download 311311itnm.exe now
Japanese: Download 311311jpnm.exe now
Korean: Download 311311korm.exe now
Localized Arabic: Download 311311larm.exe now
Localized Hebrew: Download 311311lhem.exe now
Norwegian: Download 311311norm.exe now
Polish: Download 311311polm.exe now
Portuguese (Brazil): Download 311311brzm.exe now
Portuguese (Portugal): Download 311311porm.exe now
Russian: Download 311311rusm.exe now
Slovakian: Download 311311slom.exe now
Slovenian: Download 311311svkm.exe now
Spanish: Download 311311spam.exe now
Swedish: Download 311311swem.exe now
Taiwan: Download 311311chtm.exe now
Thai: Download 311311tham.exe now
Turkish: Download 311311trkm.exe now
Release Date: October 29, 2001
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file. The English version of this fix should have the following file attributes or later:
Date Time Version Size File name
-----------------------------------------------------
25-Oct-2001 00:24 4.90.3002.0 38,672 Ssdpapi.dll
25-Oct-2001 00:24 4.90.3002.0 36,864 Ssdpsrv.exe
25-Oct-2001 00:24 4.90.3002.0 128,272 Upnp.dll
STATUS
Microsoft has confirmed that this problem may cause a degree of security vulnerability in Microsoft Windows Millennium.
MORE INFORMATION
For more information about this vulnerability, see the following Microsoft Web site:
For additional information about Windows Me hotfixes, click the article number below to view the article in the Microsoft Knowledge Base:
295413 General Information About Windows Millennium Edition Hotfixes
Additional query words: denial of service vulnerability DoS security_patch upnp
Keywords: kbhotfixserver kbqfe kbdownload kbbug kbenv kberrmsg kbfix kbqfe kbsechack kbsecurity kbsecvulnerability KB311311
