Microsoft's IGMPv3 Vulnerability Can Be Exploited - InformationWeek
IoT
IoT
Software // Enterprise Applications
News
1/30/2008
02:39 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%
RELATED EVENTS
What You Need to Know about GDPR
Aug 29, 2017
GDRP is an acronym that stands for General Data Protection Regulation and it's designed to give co ...Read More>>

Microsoft's IGMPv3 Vulnerability Can Be Exploited

Immunity Inc., a Miami computer security company, has posted a Flash video that demonstrates a proof-of-concept exploit of the networking protocol flaw.

Microsoft appears to have been overly confident in asserting that it's not likely that anyone will successfully exploit a vulnerability addressed in its most recent Security Bulletin.

Immunity Inc., a Miami, Fla., computer security company, has posted a Flash video that demonstrates a proof-of-concept exploit of the IGMPv3 networking protocol flaw discussed in Microsoft Security Bulletin MS08-001.

"This demonstrates conclusively that the MS08-001 IGMPv3 vulnerability is highly exploitable," said Dave Aitel, CTO of Immunity, in a message sent to one of the company's computer security mailing lists. "In the movie you can see the attack target a local subnet, which is populated with two Windows XP SP2 machines (with firewall enabled)."

Microsoft downplayed the significance of the vulnerability in a blog post earlier this month. "Even though this bulletin is rated Critical for XP and Vista (the bulletin describes mitigating factors that lower the severity on Windows Server 2003), there are a number of factors that make exploitation of this issue difficult and unlikely in real-world conditions," said Michael Grady, product manager in the company's Trustworthy Computing group, in a post on Microsoft's Security Vulnerability Research and Defense blog.

Microsoft Security Bulletin MS08-001 included a fix for the issue; it was updated last week "to clarify the impact of Windows Kernel TCP/IP/IGMPv3 and MLDv2 Vulnerability (CVE-2007-0069) on supported editions of Windows Small Business Server 2003 and Windows Home Server." The clarification consisted of a revision of the severity of the vulnerability on those two configurations to "Critical." Organizations that have not yet applied patched this issue are advised to do so.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
[Interop ITX 2017] State Of DevOps Report
[Interop ITX 2017] State Of DevOps Report
The DevOps movement brings application development and infrastructure operations together to increase efficiency and deploy applications more quickly. But embracing DevOps means making significant cultural, organizational, and technological changes. This research report will examine how and why IT organizations are adopting DevOps methodologies, the effects on their staff and processes, and the tools they are utilizing for the best results.
Register for InformationWeek Newsletters
White Papers
Current Issue
IT Strategies to Conquer the Cloud
Chances are your organization is adopting cloud computing in one way or another -- or in multiple ways. Understanding the skills you need and how cloud affects IT operations and networking will help you adapt.
Video
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll