For links to every topic in this issue, scroll down to the Index

Your PC doesn't have to be that slow The more you use your computer, the slower it will get. Run the all-new, free PC Pitstop PC Optimize 2.0 scan now and in just minutes receive a custom report showing you how to keep your PC running like new. Run the FREE scan now! www.pcpitstop.com

Backup your data with ZipBackup Finally, a backup program that's easy to use. ZipBackup's Wizard makes backups a snap for beginners. Filtering, scheduling, and disk spanning make it a powerful tool for experts. For a limited time, Windows Secrets readers receive 25% off. www.zipbackup.com

Get your product seen by 275,000 readers Does your company offer a product or service? Now you can place an ad in the Windows Secrets Newsletter and be seen by more than 275,000 active buyers of PC hardware and software. Bid as much or as little as you like to get the ideal ad placement. www.WindowsSecrets.com

See your ad here

How to upgrade

Contents

By Susan Bradley

In a change from its earlier statements, Microsoft now reports that some versions of Windows Server 2003 have a security flaw rated "critical" rather than merely "important."

If you didn't install security bulletin MS08-001 after its release on Jan. 8 — because you didn't feel you really needed it when it first came out — you should make time now to test your box and install the patch.

In my opinion, all versions of Windows Server 2003, including Microsoft's Small Business Server 2003, should be considered potentially vulnerable. According to Microsoft, some versions of Windows 2000, XP, Vista, and the new Windows Home Server are also affected, but those machines should already have been notified of the patch by Automatic Updates, which would have installed MS08-001 if authorized to auto-update.

If your company uses Microsoft server software, I'll describe how you can tell whether your machine is at risk from Internet attacks — and how you can close the hole.

The vulnerability occurs if an "IP multicast group," which listens for IGMP (Internet Group Management Protocol) queries, is enabled.

Windows Server 2003 ordinarily enables only multicast group 224.0.0.1, which represents all the machines on your local subnet. IGMP queries to that group are ignored. As a result, such a server would be safe from this particular attack.

Various applications, however, can enable other IGMP queries, meaning that a machine is vulnerable to exploitation. For example, Small Business Server 2003, Microsoft's more-affordable version of Windows Server, includes Exchange Server 2003, which runs WINS (Windows Internet Naming Service). That, in turn, enables the kind of IGMP queries that are open to hackers.

To test whether a server is currently vulnerable, open a command prompt and enter the following command:

netsh int ip show joins

If any multicast group other than 224.0.0.1 is listed in the output of the command, the server is open to attack. (See Figure 1.) This vulnerability is eliminated by installing MS08-001.


Figure 1. In this example, multicast groups other than 224.0.0.1 are running, making the affected server vulnerable to attack (if unpatched).

For more information, read the blog entry by Microsoft SVRD (Security Vulnerability Research & Defense) regarding the differences in multicast groups.

To download the patch, see security bulletin MS08-001. Microsoft modified this bulletin on Jan. 23 to acknowledge that SBS 2003 is vulnerable and then again on Jan. 25 to add Windows Home Server to the documentation. If you haven't applied the patch, do so now.

Contents

Contents

• Visit our Unsubscribe page.
  

Contents