Posted by Gustav Simonsson on October 10, 2015

Security Advisory [eth (cpp-ethereum) potentially vulnerable if running with UPnP enabled]

Affected configurations: Issue reported for eth (cpp-ethereum).Likelihood: MediumSeverity: HighImpact: Potentially achieve remote code execution on a machine running eth (cpp-ethereum)Details:A vulnerability found in the MiniUPnP library can potentially affect eth clients running with UPnP enabled. Effects on expected chain reorganisation depth: noneRemedial action taken by Ethereum: We are verifying whether this can indeed affect cpp-ethereum and will post an update shortly.Proposed temporary workaround: Only run eth (cpp-ethereum) with UPNP disabledby passing --upnp off to eth.ADVISORY: Disable UPnP if running the eth client (cpp-ethereum).