A new, remotely executable, exploit for XP and Vista has been demonstrated and depending on upon how a worm will use it (a worm is sure to be developed for this), this could make Slammer and Sapphire look like cake-walks. I hope I'm wrong (but I'm probably not).
The vulnerability is in Windows' implementation of IGMP - a transport layer protocol used in IP multicast - or (when translated into english) a technology utilised by many video streaming applications and online games. Of particular concern is the fact that the exploit appears to go straight through the Windows firewall, and I rather suspect it will go through the default configuration of many other firewalls too because IGMP is not usually blocked by default.
It is worth noting that any exploit utilising this vulnerability will be running in kernel space, which means that it will be allowed to do anything it chooses to do.
I suspect that lots of column inches will be devoted to this vulnerability in the coming months.
To Microsoft's credit the vulnerability (MS08-001) has been patched (the patch was released a couple of weeks ago) but unless the patch has been applied then the likelihood of infection would seem to be high - when a virus or worm is eventually created for this.
Another interesting fact is how similar this vulnerability appear to be to an older denial of service vulnerability from last year (MS06-007) that appeared to be IGMP based. Could this be caused by a bad fix to MS06-007 or is this the tip of the iceberg in a whole new class of IP stack related vulnerability's?
Time will tell.
Futher reading:
- Computerworld - New attack proves critical Windows bug 'highly exploitable'
- Symantec - Microsoft Windows TCP/IP IGMP MLD Remote Code Execution Vulnerability
Delicious
Digg
StumbleUpon
Reddit
Technorati
 | Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution-Share Alike 2.0 UK: England & Wales License. |
| NOTICE: | NO CONSENT IS GIVEN FOR INTERCEPTION OF PAGE TRANSMISSION |
Comments
The process for a full
The process for a full uninstall that was necessary to get it out of your hair as a standard system user can be pretty scary for someone who isn't a bona-fide expert computer user. Even most so-called Power Users should be vary leery of following those instructions. Those of us who have actually gotten to the point where we edited registry keys for a living (yes, I had a job a few years back that included that unenviable task, and I got quite good at doing so quickly and safely), on the other hand, should find it pretty simple. On the other hand, making it a per-user component means that when one user uninstalls it, another can still have it. If you're uninstalling it for security reasons, this should set off a warning klaxon in your head, complete with flashing red lights. If you're the only person who ever uses your computer, this might mitigate the problem somewhat,
----------------------
testking pmp | PW0-104 | rcdd | scjp
Spelling Ma'am strikes!
<pedant>It's vulnerability not venerability, venerability is how deserving of veneration one is!</pedant> ^__^
Oops
[facepalm]
I guess I was tired when I wrote that, I hope it's better now.
Post new comment