Microsoft Windows TCP/IP is the network communication protocol that is used by all Microsoft operating systems.  The two components affected by remote code execution vulnerabilities, IGMPv3 (XFID 39452) and MLDv2 (XFID  39453), are enabled by default.  Although MLDv2 is available only on Windows Vista for IPv6 support, IGMPv3 is available on all affected platforms.  An attacker does not need to invoke any kind of user interaction to exploit this vulnerability.  The lack of user interaction, widespread availability of the protocols, and the possibility of complete compromise of targeted systems means that administrators should treat this vulnerability as highly critical.

The lack of user interaction makes this exploit a probable target for botnets, such as the Storm Worm.  Administrators should monitor the signatures listed in the ISS Coverage section for any attempted worm or botnet activity.  Administrators should also keep in mind that multicast traffic is usually received by multiple destinations, so a single stream of attack traffic would likely affect more than one target.

The tertiary issue disclosed by this advisory (XFID 39254) is a DoS with potential for remote code execution.  The DoS is easily achievable and could affect the availability of systems and, therefore, the productivity of users.  Although the affected component, Router Discovery Protocol (RDP) is not enabled by default, it could be enabled by a setting in DHCP or by a setting in the registry.

TCP/IP stores the state for each multicast interface in separate structures. These structures contain group and source addresses, timeout progress, mode, and other state data. Kernel timer objects are responsible for maintaining these structures. In addition, timers also handle multicast state events from the network and host. 

• TCP/IP IGMPv3.  SSM timers are vulnerable to buffer overflows when processing state structures. As a result, an anonymous, remote attacker or malware could execute arbitrary code in the kernel by sending a crafted sequence of IGMPv3 packets. (CVE-2007-0069/XFID 39452)
• TCP/IP MLDv2.  On Windows Vista, the MLDv2 is also affected by the vulnerable SSM timers. As a result, an anonymous, remote attacker or malware could execute arbitrary code in the kernel by sending a crafted sequence of MLDv2 packets. (CVE-2007-0069/XFID 39453)
• TCP/IP ICMP. Due to the way the way the kernel processes fragmented router advertisement ICMP queries, an anonymous, remote attacker or malware could cause a DoS and possibly achieve remote code execution by sending specially-crafted ICMP packets. (CVE-2007-0066/XFID 39254)

Patches are available for this issue. See References for details.