Windows Small Business Server at risk from critical flaw

Microsoft said Wednesday that another one of its operating system products
is vulnerable to a critical vulnerability, first patched two weeks ago.

In an update to its MS08-001
security bulletin, Microsoft said that the latest release of Windows Small Business
Server was also critically at risk from a bug in Windows' networking software.

The flaw is also considered critical for Windows XP and Vista users. Microsoft
did not say why it had initially omitted Small Business Server from its list
of critically affected operating systems, but it said that the product's users
were being offered patches via Microsoft's various automatic update services.
"Customers with Windows Small Business Server 2003 Service Pack 2 should
apply the update to remain secure," Microsoft said in its updated bulletin.

The bug lies in the way Windows processes networking traffic that uses IGMP
(Internet Group Management Protocol) and MLD (Multicast Listener Discovery)
protocols, which are used to send data to many systems at the same time. Microsoft
said that an attacker could send specially crafted packets to a victim's machine,
which could then allow the attacker to run unauthorized code on a system.

Microsoft rates the flaw as "important" for Windows Server 2003,
meaning that it would be more difficult for attackers to exploit the flaw on
this operating system.

Security experts are paying particular attention to this vulnerability because
it could be exploited by attackers to create a self-replicating worm attack.

The flaw is not being exploited in online attacks, but last week researchers
at penetration-testing-software vendor Immunity made a sample exploit available
to their customers. That software causes an unpatched system to crash, but the
company is close to developing code that could be used to install unauthorized
software on a victim's computer, according to Immunity Chief Technology Officer
Dave Aitel.

Aitel said it's no surprise that the small business version of Windows Server
2003 is at risk.

"I assumed most 2003 servers in the real world were vulnerable,"
he said via instant message. "Windows Server 2003 by default does not have
any multicast addresses active and would not be affected by this vulnerability.
However, installing applications that use multicasting could cause the operating
system to become vulnerable."

He said that Microsoft could help its customers by giving them more details
on how to avoid being at risk to this problem. "What features can I enable
on Windows Server 2003 to become vulnerable?" he asked.