Microsoft's IGMPv3 Vulnerability Can Be Exploited 2

Microsoft appears to have been overly confident in asserting that it's not likely that anyone will successfully exploit a vulnerability addressed in its most recent Security Bulletin.

Immunity Inc., a Miami, Fla., computer security company, has posted a Flash video that demonstrates a proof-of-concept exploit of the IGMPv3 networking protocol flaw discussed in Microsoft Security Bulletin MS08-001.

"This demonstrates conclusively that the MS08-001 IGMPv3 vulnerability is highly exploitable," said Dave Aitel, CTO of Immunity, in a message sent to one of the company's computer security mailing lists. "In the movie you can see the attack target a local subnet, which is populated with two Windows XP SP2 machines (with firewall enabled)."

Microsoft downplayed the significance of the vulnerability in a blog post earlier this month. "Even though this bulletin is rated Critical for XP and Vista (the bulletin describes mitigating factors that lower the severity on Windows Server 2003), there are a number of factors that make exploitation of this issue difficult and unlikely in real-world conditions," said Michael Grady, product manager in the company's Trustworthy Computing group, in a post on Microsoft's Security Vulnerability Research and Defense blog.

Microsoft Security Bulletin MS08-001 included a fix for the issue; it was updated last week "to clarify the impact of Windows Kernel TCP/IP/IGMPv3 and MLDv2 Vulnerability (CVE-2007-0069) on supported editions of Windows Small Business Server 2003 and Windows Home Server." The clarification consisted of a revision of the severity of the vulnerability on those two configurations to "Critical." Organizations that have not yet applied patched this issue are advised to do so.