Software // Enterprise Applications
News
1/30/2008
02:39 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft's IGMPv3 Vulnerability Can Be Exploited

Immunity Inc., a Miami computer security company, has posted a Flash video that demonstrates a proof-of-concept exploit of the networking protocol flaw.

Microsoft appears to have been overly confident in asserting that it's not likely that anyone will successfully exploit a vulnerability addressed in its most recent Security Bulletin.

Immunity Inc., a Miami, Fla., computer security company, has posted a Flash video that demonstrates a proof-of-concept exploit of the IGMPv3 networking protocol flaw discussed in Microsoft Security Bulletin MS08-001.

"This demonstrates conclusively that the MS08-001 IGMPv3 vulnerability is highly exploitable," said Dave Aitel, CTO of Immunity, in a message sent to one of the company's computer security mailing lists. "In the movie you can see the attack target a local subnet, which is populated with two Windows XP SP2 machines (with firewall enabled)."

Microsoft downplayed the significance of the vulnerability in a blog post earlier this month. "Even though this bulletin is rated Critical for XP and Vista (the bulletin describes mitigating factors that lower the severity on Windows Server 2003), there are a number of factors that make exploitation of this issue difficult and unlikely in real-world conditions," said Michael Grady, product manager in the company's Trustworthy Computing group, in a post on Microsoft's Security Vulnerability Research and Defense blog.

Microsoft Security Bulletin MS08-001 included a fix for the issue; it was updated last week "to clarify the impact of Windows Kernel TCP/IP/IGMPv3 and MLDv2 Vulnerability (CVE-2007-0069) on supported editions of Windows Small Business Server 2003 and Windows Home Server." The clarification consisted of a revision of the severity of the vulnerability on those two configurations to "Critical." Organizations that have not yet applied patched this issue are advised to do so.

Comment  | 
Print  | 
More Insights
Building A Mobile Business Mindset
Building A Mobile Business Mindset
Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps – and it's past time for those with no plans to get cracking.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest - September 10, 2014
A high-scale relational database? NoSQL database? Hadoop? Event-processing technology? When it comes to big data, one size doesn't fit all. Here's how to decide.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
A look at the top stories from InformationWeek.com for the week of September 7, 2014.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.