Bugtraq mailing list archives

Re: Ssdpsrv.exe in WindowsME


From: Mark Watts <m.watts () qinetiq com>
Date: Fri, 19 Oct 2001 10:11:30 +0100

I can confirm that Win ME *can* have this service installed.

It's part of the Universal Plug and Play feature that is available as one of 
the 'packages' ME allows you to install.  Removing this package (via the 
add/remove programs feature) will remove this service.

I am unnaware of what makes this service get installed as I have only come 
across it once. A 'regular' installation of ME does NOT install this afaict, 
I believe you have to do a custom install.

Mark.

On Thursday 18 October 2001 9:11 pm, Stefan Laudat wrote:
Ssdpsrv.exe is the file that starts the UPnP server on WindowsME boxes.
This service comes standard with the WindowsME installation.

<wondering mode on>

But it isn't neither loaded at startup nor installed with standard WinME
installation. Have a look :-/

C:\WINDOWS\Desktop>ver

Windows Millennium [Version 4.90.3000]

C:\WINDOWS\Desktop>ipconfig

Windows IP Configuration

0 Ethernet adapter :

        IP Address. . . . . . . . . : 172.16.252.2
        Subnet Mask . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . : 172.16.252.1

C:\WINDOWS\Desktop>dir c:\windows\system\ss*.*

 Volume in drive C is MACIUCA
 Volume Serial Number is 323E-0FF2
 Directory of C:\WINDOWS\SYSTEM

File not found
                         2.560.61 MB free


[root@bunker /root]# nmap -sT 172.16.252.2

Starting nmap V. 2.54BETA7 ( www.insecure.org/nmap/ )
Interesting ports on ninja (172.16.252.2):
(The 1533 ports scanned but not shown below are in state: closed)
Port       State       Service
139/tcp    open        netbios-ssn

Nmap run completed -- 1 IP address (1 host up) scanned in 1 second

[root@bunker /root]# telnet ninja 5000
Trying 172.16.252.2...
telnet: Unable to connect to remote host: Connection refused

Ahem... grabbed my IBM T22 notebook, erased an ext2 partition of it,
installed winme using only typical settings, yet no result.

</wondering mode on>

Now, please enlighten me a bit:
1. Are you sure about this ? How many platforms did you actually test
before reporting it to anyone?
2. Are there any special WinME installation settings that you checked
during the setup process ?
3. Did you actually notify Microsoft as normal people should behave?

This causes the server crash and closes port 5000.
Either you must restart the server by manually running ssdpsrv.exe
or reboot.

Or either a guy who got his shots should report it to Microsoft
support so we can eventually get an update.


Current thread: