By
Philip Churchill on January 30th, 2008
We bought to your attention the other day that the vulnerabilities detailed in the MS08-001 security bulletin also affect Windows Home Server.
The security bulletin which was first issued on January 8th was revised on January 25th when Microsoft announced that Windows Small Business Server and Windows Home Server was also at risk, neither of which had been mentioned in the original bulletin.
Windows Small Business Server and Windows Home Server both have IGMP (Internet Group Management Protocol) enabled by default and this results in a greater exposure to the same vulnerability. That’s why for these two operating systems Microsoft has given the vulnerability a severity rating of “Critical”.
An attacker could exploit the vulnerability by sending specially crafted ICMP packets to a computer over the network and could cause the computer to stop responding and automatically restart. An attacker could also take complete control of an affected system and could then install programs; view, change, or delete data; or create new accounts with full user rights.
The update will be installed as part of Windows/Microsoft Update, as long as you have it set to automatically do so, of course. Otherwise the update will be listed as KB941644 on the Update Website, which you can access on the server machine directly. Or you can install all updates requires for WHS via the Console,Settings, General tab and pressing Update Now. All Windows Home Server users should apply this update to remain secure.