No. Part of UPnP is a service on the firewall that responds to UPnP clients
by modifying the firewall to punch holes through as the client requests. Eg., a
client can ask the firewall to open a listening port on the Internet side and
connect that port to a certain port on the client, allowing outside systems
direct access to the client (eg. to allow for direct inbound connections for
VoIP telephony or peer-to-peer file sharing software). That's why they mention
the vulnerabilities in the libupnp Linux package, that's the part that would run
on a Linux-based router to provide the UPnP service there. I looked at that, and
after chewing on the documentation a bit decided there was no safe way to deploy
that and I'd handle such things by manual configuration in a for-the-purpose
script in my firewall setup. I don't have a philosophical objection to direct
inbound connections through a firewall, only an objection to their existence
being controlled by anyone other than the network administrator. And especially
when any software on a machine can request them, there's no way to distinguish
an allowable request from a request from a bit of malware. [ Reply to This | Parent | # ]
|
