Multiple (3) Microsoft Windows TCP/IP Remote Code Execution and DoS Vulnerabilities

Notification Type: IBM Internet Security Systems Protection Advisory
Notification Date: Jan. 8, 2008
Notification Version: 1.2
   
Name: Multiple (3) Microsoft Windows TCP/IP Remote Code Execution and DoS Vulnerabilities
Public disclosure/
In the wild date:
Jan. 8, 2008 (vuln disclosure)
CVE:

CVE-2007-0066 and CVE-2007-0069

Description:

Two vulnerabilities in Microsoft Windows TCP/IP could allow remote code execution, and one vulnerability could allow a remote denial of service (DoS) and possibly remote code execution. 

An anonymous, remote attacker or malware could cause a DoS or execute arbitrary code in the TCP/IP kernel driver by sending a specially-crafted sequence of SSM (Source Specific Multicasting) packets or ICMP packets.  None of these vulnerabilities require user intervention to be successful.

Discoverers: Alex Wheeler and Ryan Smith of IBM X-Force

 

ISS Coverage

Product Content Version
Proventia Network IDS
Proventia Network IPS
Proventia Network MFS
RealSecure Network
RealSecure Server Sensor*
27.070  / 27.130 (ICMP issue)
Proventia Desktop
Proventia Server IPS
x.x.x.2080  / 2140 (ICMP issue)
Propagation Techniques ISS Protection Available
remote exploit SSM_List_BO
ICMP_Router_Advertisement_Dos
Aug 16, 2007
Jan 08, 2007

Detailed Description

Business Impact:

Microsoft Windows TCP/IP is the network communication protocol that is used by all Microsoft operating systems.  The two components affected by remote code execution vulnerabilities, IGMPv3 (XFID 39452) and MLDv2 (XFID  39453), are enabled by default.  Although MLDv2 is available only on Windows Vista for IPv6 support, IGMPv3 is available on all affected platforms.  An attacker does not need to invoke any kind of user interaction to exploit this vulnerability.  The lack of user interaction, widespread availability of the protocols, and the possibility of complete compromise of targeted systems means that administrators should treat this vulnerability as highly critical.

The lack of user interaction makes this exploit a probable target for botnets, such as the Storm Worm.  Administrators should monitor the signatures listed in the ISS Coverage section for any attempted worm or botnet activity.  Administrators should also keep in mind that multicast traffic is usually received by multiple destinations, so a single stream of attack traffic would likely affect more than one target.

The tertiary issue disclosed by this advisory (XFID 39254) is a DoS with potential for remote code execution.  The DoS is easily achievable and could affect the availability of systems and, therefore, the productivity of users.  Although the affected component, Router Discovery Protocol (RDP) is not enabled by default, it could be enabled by a setting in DHCP or by a setting in the registry.

CVSS  for XFIDs 39452 and  39453: Base Score: 10.0
  Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality Impact: Complete
Integrity Impact: Complete
Availability Impact: Complete
Adjusted Temporal Score: 7.4
  Exploitability: Unproven
Remediation Level: Official-Fix
Report Confidence: Confirmed
CVSS  for XFID 39254: Base Score: 7.8
  Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Complete
Adjusted Temporal Score: 5.8
  Exploitability: Unproven
Remediation Level: Official-Fix
Report Confidence: Confirmed
Affected Products: For a full list of affected versions, see references below.
Technical Description:

TCP/IP stores the state for each multicast interface in separate structures. These structures contain group and source addresses, timeout progress, mode, and other state data. Kernel timer objects are responsible for maintaining these structures. In addition, timers also handle multicast state events from the network and host. 

  • TCP/IP IGMPv3.  SSM timers are vulnerable to buffer overflows when processing state structures. As a result, an anonymous, remote attacker or malware could execute arbitrary code in the kernel by sending a crafted sequence of IGMPv3 packets. (CVE-2007-0069/XFID 39452)
  • TCP/IP MLDv2.  On Windows Vista, the MLDv2 is also affected by the vulnerable SSM timers. As a result, an anonymous, remote attacker or malware could execute arbitrary code in the kernel by sending a crafted sequence of MLDv2 packets. (CVE-2007-0069/XFID 39453)
  • TCP/IP ICMP. Due to the way the way the kernel processes fragmented router advertisement ICMP queries, an anonymous, remote attacker or malware could cause a DoS and possibly achieve remote code execution by sending specially-crafted ICMP packets. (CVE-2007-0066/XFID 39254)
Remediation:

Patches are available for this issue. See References for details.

References

XFDB http://xforce.iss.net/xforce/xfdb/39452
http://xforce.iss.net/xforce/xfdb/39453
http://xforce.iss.net/xforce/xfdb/39254
Microsoft: http://www.microsoft.com/technet/security/Bulletin/MS08-001.mspx

Revision History

1.0 Initial publication.
1.1 Added host-based product coverage.
1.2 Clarified host-based product coverage.
1.3 Fixed incorrect links in Business Impact section.


About IBM Internet Security Systems
IBM Internet Security Systems is the trusted security advisor to thousands of the world's leading businesses and governments, providing pre-emptive protection for networks, desktops and servers. An established leader in security since 1994, the IBM Proventia® integrated security platform is designed to automatically protect against both known and unknown threats, helping to keep networks up and running and shielding customers from online attacks before they impact business assets. IBM Internet Security Systems products and services are based on the proactive security intelligence of its X-Force® research and development team – the unequivocal world authority in vulnerability and threat research. The Internet Security Systems product line is also complemented by comprehensive Managed Security Services and Professional Security Services. For more information, visit the Internet Security Systems Web site at www.iss.net or call 800-776-2362.