Vulnerability Alert

Microsoft Windows XP SP2 and prior, Windows Server 2003 SP2 and prior, Windows Business Server 2003 SP2 and prior, and Windows Vista contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code with elevated privileges.

This vulnerability exists due to insufficient validation of Internet Group Management Protocol (IGMP) and Multicast Listener Discovery (MLD) network messages. An attacker could exploit this vulnerability by sending a malicious network message to the affected system. When processed, this network message could trigger an error condition that may allow the attacker to execute arbitrary code with full system privileges.

Microsoft has confirmed this vulnerability in a security bulletin and released software updates that correct it.

Systems that are running the following software are vulnerable:

• Microsoft Windows XP SP2 and prior
• Microsoft Windows XP Professional x64 Edition SP2 and prior
• Microsoft Windows Server 2003 SP2 and prior
• Microsoft Windows Server 2003 x64 Edition SP2 and prior
• Windows Server 2003 with SP2 and prior for Itanium-based Systems
• Microsoft Windows Small Business Server 2003 SP2 and prior
• Windows Vista
• Windows Vista x64 Edition

Systems most at risk are those that may process IGMPv3 or MLDv2 messages from untrusted networks. IGMP and MLD are typically used only on local physical network segments. However, some network configurations may allow such messages to be passed across segments. Such messages likely will not pass through network edge filtering devices, such as gateways or firewalls. Attackers therefore likely require access to internal network segments to target affected systems. An exploit could allow the attacker to execute arbitrary code with the privileges of the Windows kernel, resulting in a complete system compromise.

The IGMPv3 protocol is used to perform multicast group management on IPv4 networks. The MLDv2 protocol is the IPv6 implementation of IGMP.

Networks that are not configured to process multicast traffic are unlikely to be affected because network switches and routers will discard such packets. This would prevent a remote attacker from delivering a malicious payload to an affected system. However, a local attacker who wants to gain elevated privileges may be able to send a malicious request to himself or herself via the loopback interface to trigger the vulnerability.

Because this is a vulnerability in the processing of multicast packets, an attacker in the proper position could potentially compromise or deny service to a large number of machines with a single attack. This makes the potential impact of this vulnerability quite severe. An attacker who exploits desktop and server systems that do not perform domain authentication can compromise only the affected hosts. If an attacker could successfully attack a system that performs Active Directory and domain authentication functions, the integrity of the entire domain may be compromised.

The update available from Microsoft corrects this vulnerability by properly validating network messages.

Coinciding with each monthly Microsoft release, the Cisco Applied Intelligence team creates an Applied Mitigation Bulletin to address Microsoft vulnerabilities from this period that may be effectively identified and/or mitigated using Cisco network devices. This bulletin is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin for January 2008

Microsoft has re-released a security bulletin at the following link: MS08-001

Avaya has released a security advisory at the following link: ASA-2008-019

US-CERT has released a vulnerability note at the following link: VU#115083