Vulnerability Note VU#839284

Microsoft Windows TCP/IP fails to properly validate IGMP packets

The Transmission Control Protocol (TCP) is defined in RFC 793 as a means to provide reliable host-to-host transmission between hosts in a packet-switched computer network. The Internet Group Management Protocol version 3 (IGMPv3) is defined in RFC 3376 as a protocol to help manage multicast connections over the internet.

The Vulnerability

The Microsoft implementation of TCP/IP fails to properly handle specially crafted IGMPv3 packets, possibly leading to a denial-of-service condition. For more information, including a list of vulnerable systems, please refer to Microsoft Security Bulletin MS06-007.

II. Impact

Microsoft has addressed this issue in Microsoft Security Bulletin MS06-007.


Please see Microsoft Security Bulletin MS06-007 for a list of workarounds to mitigate this vulnerability.

Systems Affected

http://www.microsoft.com/technet/security/bulletin/ms06-007.mspx
http://www.ietf.org/rfc/rfc3376.txt
http://www.ietf.org/rfc/rfc793.txt

Credit

This vulnerability was reported in Microsoft Security Bulletin MS06-007. Microsoft credits Douglas Nascimento of Datacom with providing information regarding this issue.

This document was written by Jeff Gennari.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.