Immunity Inc., a Miami computer security company, has posted a Flash video that demonstrates a proof-of-concept exploit of the networking protocol flaw.
Microsoft appears to have been overly confident in asserting that it's not likely that anyone will successfully exploit a vulnerability addressed in its most recent Security Bulletin.
Immunity Inc., a Miami, Fla., computer security company, has posted a Flash video that demonstrates a proof-of-concept exploit of the IGMPv3 networking protocol flaw discussed in Microsoft Security Bulletin MS08-001.
"This demonstrates conclusively that the MS08-001 IGMPv3 vulnerability is highly exploitable," said Dave Aitel, CTO of Immunity, in a message sent to one of the company's computer security mailing lists. "In the movie you can see the attack target a local subnet, which is populated with two Windows XP SP2 machines (with firewall enabled)."
Microsoft downplayed the significance of the vulnerability in a blog post earlier this month. "Even though this bulletin is rated Critical for XP and Vista (the bulletin describes mitigating factors that lower the severity on Windows Server 2003), there are a number of factors that make exploitation of this issue difficult and unlikely in real-world conditions," said Michael Grady, product manager in the company's Trustworthy Computing group, in a post on Microsoft's Security Vulnerability Research and Defense blog.
Microsoft Security Bulletin MS08-001 included a fix for the issue; it was updated last week "to clarify the impact of Windows Kernel TCP/IP/IGMPv3 and MLDv2 Vulnerability (CVE-2007-0069) on supported editions of Windows Small Business Server 2003 and Windows Home Server." The clarification consisted of a revision of the severity of the vulnerability on those two configurations to "Critical." Organizations that have not yet applied patched this issue are advised to do so.
[Interop ITX 2017] State Of DevOps ReportThe DevOps movement brings application development and infrastructure operations together to increase efficiency and deploy applications more quickly. But embracing DevOps means making significant cultural, organizational, and technological changes. This research report will examine how and why IT organizations are adopting DevOps methodologies, the effects on their staff and processes, and the tools they are utilizing for the best results.
2017 State of IT ReportIn today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.