Microsoft's IGMPv3 Vulnerability Can Be Exploited

[HardOCP News]

What is the best way to find out whether or not a vulnerability can be exploited? Downplay its significance and wait until someone demonstrates a proof-of-concept exploit….wait, that’s not the best way. What was the question again?

"This demonstrates conclusively that the MS08-001 IGMPv3 vulnerability is highly exploitable," said Dave Aitel, CTO of Immunity, in a message sent to one of the company's computer security mailing lists. "In the movie you can see the attack target a local subnet, which is populated with two Windows XP SP2 machines (with firewall enabled)."

 

[ICOM]

"there are a number of factors that make exploitation of this issue difficult and unlikely in real-world conditions"

oh...Brilliant!

Nothing like bating the scumbags...

 

[ICOM]

baiting...

 

[Exavior]

Did I read it correctly this problem has already been patched and this proof-of-concept only works on a unpatched system?

If so I don't really see the problem. Microsoft fixed a flaw that they didn't think would be exploited. Only later to find out that it could be exploited had they not made a patch for it. Since they did make a patch for it, anyone that keeps their machine up to date as one should wouldn't have to worry about this problem.

 

[tacosareveryyummy]

People just want to bash Microsoft like usual. I don't see why people don't just:
1. Get over it
2. Move to open source

I have been computing for over 10 years and I have yet to have a problem with hackers, ect. But then again I don't go around the web giving out my credit card numbers or leaving my system open for attack. Microsoft seems to have fixed the issue so this seems like a moot point.

 

[L33t Masta]

Most perople don't care as it doesn't effect the casual user and certainly doesn;t effect those of us who need it. ANd people don';t move to open source because they have an OS that already works and gets patched professionally. Why would they want to move to something that's broken?

 

[tacosareveryyummy]

Open source isn't broken at all. Still, if people are going to complain about a Microsoft OS because their mother's brother's sister's former roommate told them it sucks then they should just move to a new os.

 

[Tech^Cellfish]

I read this as:

1. Microsoft saying this isn't a big a big problem, and hard to exploit
2 .Security company showing off how easy it is
3. Microsoft understands every metasploit kid can to this and changes it to a Critical update

I think it is newsworthy.

 

[HOCP4ME]

I read this as:

1. Microsoft saying this isn't a big a big problem, and hard to exploit
2 .Security company showing off how easy it is
3. Microsoft understands every metasploit kid can to this and changes it to a Critical update

I think it is newsworthy.

So Microsoft was proven wrong, admitted their mistake, and quickly fixed the problem.

What's the issue? Even Microsoft security guys can't be right every time.

 

[Exavior]

So Microsoft was proven wrong, admitted their mistake, and quickly fixed the problem.

What's the issue? Even Microsoft security guys can't be right every time.

The way I took it was that they already fixed the problem but had it listed as a normal security update saying that it wasn't that big of a deal. Then the security company showed that it was a bigger deal that microsoft said they then switched it from being a normal security update to being critical. Either way I understand it to be saying that the problem was already patched before this company released their findings.

 

[HOCP4ME]

The way I took it was that they already fixed the problem but had it listed as a normal security update saying that it wasn't that big of a deal. Then the security company showed that it was a bigger deal that microsoft said they then switched it from being a normal security update to being critical. Either way I understand it to be saying that the problem was already patched before this company released their findings.

In that case it's even less of a mistake.

 

[Exavior]

In that case it's even less of a mistake.

After rereading the article again, it has always been listed as critical but on the Security Vulnerability Research & Defense blog had the statement that it wouldn't be that easy for somebody to talk advantage of thus they seen it as being a unlikely real world threat. So actually they didn't even change the category of it. They just added Windows 2003 server and Home Server as being effect as they didn't think those two were effected by it at first. However that could just be something they found during further testing.

This is the statement in full with its list of why they didn't think it would be too likely for it to be wide spread.

Even though this bulletin is rated Critical for XP and Vista (the bulletin describes mitigating factors that lower the severity on Windows Server 2003) there are a number of factors that make exploitation of this issue difficult and unlikely in real-world conditions:

An attack is likely to cause high CPU usage by the target, unless packets are sent slowly. Due to the way the TCP/IP code processes incoming SSM messages, the machine will consume large amounts of CPU when it is under attack. This can be controlled to some extent by the attacker by sending fewer packets per second. An attacker trying to send packets blindly at full speed will cause the target to use 100% CPU and become unresponsive. This has the effect of causing the TCP/IP code to drop messages, which makes it harder for the attacker to control the attack and make exploitation reliable.
The attack is timing-sensitive, due to the nature of the IGMP protocol and the high CPU usage that is likely on the target machine.
The IGMP protocol requires the use of a timer which is used to trigger a multicast report (which triggers the vulnerable code). The timer is created when the initial IGMPv3 or MLDv2 query message is received. The TCP/IP stack chooses a random value between (0,MaxResponseTime), where MaxResponseTime is the value in the received query (attacker controlled). Each new IGMPv3/MLDv2 query that is received can have a different MaxResponseTime value in it. The existing timer is updated by selecting a random number between (0,MaxResponseTime), but only if the new value is smaller than the current value. This means that the attacker can:
Specify the upper-limit of the timer value
Trigger an immediate timer expiration at will. This is useful when launching an attack since the attack packets can use a large MaxResponseTime value, except for the last packet which uses a small value. This will then trigger the timer soon after the last packet is received.
However, since the timer value is chosen randomly, the attacker does not know when the timer will expire. Let’s assume the attack requires 300 packets worth of data. The attacker can send their packets, but the timer may expire mid-way through the transmission. When the timer fires, the list is emptied (and no overflow happens). The 2nd half of the attack continues and fills the list again, but there is no longer enough data to successfully attack the vulnerability.

The attacker can run their attack non-stop, and eventually they will be lucky enough to have the timer fire with the appropriate conditions to trigger the vulnerability. However, they don’t know for sure how many packets to send, or what will be in the buffer when they trigger the vulnerability.

So all it comes down to then is that they released a critical patch, found out later that the problem they fixed was a little easier to take advantage of than they orginially thought.

 

[L33t Masta]

Open source isn't broken at all. Still, if people are going to complain about a Microsoft OS because their mother's brother's sister's former roommate told them it sucks then they should just move to a new os.

Open Source being broken is it's nature. It depends on people to open the source code and fix it.