Microsoft has confirmed a critical flaw could allow an attacker to take complete control of an affected system, once in control they could then install programs; view, change, or delete data; or create new accounts with full user rights. The vulnerability occurs if an “IP multicast group” is enabled, this listens for Internet Control Message Protocol (IGMP) queries.

ICMP has two main funtions, first it carries requests and reply data for diagnostic programs like the PING command, it also provides error reporting services for intermediate systems

Microsoft has released a critical security update for all supported editions of Windows XP, Windows Vista and an important security update for all supported editions of Windows Server 2003, this includes Small Business Server (SBS) 2003.

The security bulletin MS08-001 is available on the Microsoft web site and was released early in January this year, however, Microsoft modified this bulletin on 23 January 2008 to acknowledge that SBS 2003 is also vulnerable and then again on 25 January 2008 to add Windows Home Server to the documentation. For more information, see the security bulletin subsection: “Affected and Non-Affected Software”.

To try and explain the vulnerability, let us look at Server 2003, this enables multicast group 224.0.0.1 by default, which represents all the computers on your local subnet, any ICMP queries to that group are ignored. However, various applications can enable other ICMP queries, meaning that a computer is vulnerable to exploitation. For example: SBS Server 2003 includes Exchange Server 2003, which runs WINS (Windows Internet Naming Service). That, in turn, enables the kind of ICMP queries that are open to hackers.

For more information, read the blog entry by Microsoft Security Vulnerability Research & Defense (SVRD) regarding the differences in multicast groups.

To test whether a server is currently vulnerable, open a command prompt and enter the following command:

NETSH INT IP SHOW JOINS

This command will show the multicast groups to which the server is joined. If any multicast group other than 224.0.0.1 is listed in the output of the command, the server is open to attack. This vulnerability is eliminated by installing security bulletin MS08-001.

.