Unchecked Buffer in Universal Plug and Play Can Lead to System Compromise for Windows XP (Q315000) By sending a specially-malformed NOTIFY directive, it would be possible for an attacker to cause code to run in the context of the UPnP service, which runs with system privileges on Windows XP. The UPnP implementations do not adequately regulate how it performs this operation, and this gives rise to two different denial-of-service scenarios. (CVE-2001-0877) See http://www.microsoft.com/technet/security/bulletin/ms01-059.mspx