Unscored severity · published Dec 20, 2001
CVE-2001-0877
Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to cause a denial of service via (1) a spoofed SSDP advertisement that causes the client to…
–
CVSS
43.8%
EPSS
No
On KEV
Description
Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to cause a denial of service via (1) a spoofed SSDP advertisement that causes the client to connect to a service on another machine that generates a large amount of traffic (e.g., chargen), or (2) via a spoofed SSDP announcement to broadcast or multicast addresses, which could cause all UPnP clients to send traffic to a single target system.
Exploitation
Is it being used?
Exploit prediction (EPSS)43.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
W9
Windows 98 · Microsoft
All versions, or not specified · source: NVD
W9
Windows 98se · Microsoft
All versions, or not specified · source: NVD
WM
Windows ME · Microsoft
All versions, or not specified · source: NVD
WX
Windows XP · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-0877
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-0877
marc.info
http://marc.info/?l=bugtraq&m=100887440810532&w=2
marc.info
http://marc.info/?l=ntbugtraq&m=100887271006313&w=2
Patch
http://www.cert.org/advisories/CA-2001-37.html
www.ciac.org
http://www.ciac.org/ciac/bulletins/m-030.shtml
US Government Resource
http://www.kb.cert.org/vuls/id/411059
Vendor Advisory
http://www.securityfocus.com/archive/1/249238
More from Windows 98
9.8
CVE-2000-1218
The default configuration for the domain name resolver for Microsoft Windows 98, NT 4.0, 2000, and XP sets the QueryIpMatching parameter to 0, which causes Windows to accept DNS…
7.8
CVE-2003-1048
Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF…
–
CVE-1999-1593
Windows Internet Naming Service (WINS) allows remote attackers to cause a denial of service (connectivity loss) or steal credentials via a 1Ch registration that causes WINS to…
–
CVE-2006-1313
Microsoft JScript 5.1, 5.5, and 5.6 on Windows 2000 SP4, and 5.6 on Windows XP, Server 2003, Windows 98 and Windows Me, will "release objects early" in certain cases, which…
–
CVE-2006-2376
Integer overflow in the PolyPolygon function in Graphics Rendering Engine on Microsoft Windows 98 and Me allows remote attackers to execute arbitrary code via a Windows Metafile…