New Virus hitting hard and furious!!!

http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html ^ | 08/11/03 | self

[STFrancis]

All,

Here a scoop to Freepers which is just now hitting us security pro's.

There is a first vulnerability that uses the MS Bug that MS addressed with MS 03-026 two weeks ago.

It is calling itself MSBLAST.exe and is spreading in the wild unbelievably fast. http://isc.sans.org/diary.html?date=2003-08-11

A first advisory from McAffee has just been published: http://us.mcafee.com/virusInfo/defa...&virus_k=100547 Once it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp. The exploit itself is very close to 'dcom.c' and so far appears to use the "universal Win2k" offset only.

In other words we need to make sure port 4444 is blocked inbound AND outbound.

Of course this is in addition to the MS03-026 patch being installed which Microsoft released two weeks ago (more info regarding the patch here: http://www.microsoft.com/technet/tr...n/MS03-026.asp.

Another advisory was JUST posted by Symantec: http://www.symantec.com/avcenter/ve...aster.worm.html

Just thought everyone ought to know.

Thanks...

[Knitebane]

Bugtrac http://msgs.securepoint.com/cgi-bin/get/bugtraq0105/92.html

Local exploit only, and only on x86 versions, not Sparc versions.

OpenBSD http://www.insecure.org/sploits/OpenBSD.lprm.overflow.html

Interesting exploit, but also local only.

I will list here the conditions that must be met for the exploit to work:

You have a remote printer configured in /etc/printcap.

The length of the attacker's username plus the length of the "rp" capability for the remote printer is >= 7.

The hostname of the remote printer (i.e. the "rm" capability) resolves, and neither the canonical name returned for the host nor any of its aliases match the local hostname.

And all of this on a version which was, at the time of the exploit being found, two versions old.

Trusted Solaris - from Sun's own website! http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/199

Not a Trusted Solaris bug. Can affect Trusted Solaris if you install Java, which is not installed by default.

No software is perfect, but none of the exploits you listed would make it possible for a " average-skilled computer consultants trained in simple yet effective hacks" to crack a machine running OpenBSD or Trusted Solaris remotely, that is, across a network connection. That is what you claimed, after all, but have failed to provide evidence of.

It's good that you won't be coming back to troll anymore. Begone and good riddance, Microsoft apologist.

[MrsEmmaPeel]

Well, look what we have here. Apple just released the following: Quoting from Apple

Security Update 2003-08-14 is now available APPLE-SA-2003-08-14 realpath.

It addresses CAN-2003-0466, a potential vulnerability in the fb_realpath() function, used by the FTPServer and Libc projects, which could allow a local or remote user to gain unauthorized root privileges to a system.

Now then, when you do a search, for CAN-2003-0466 on CERT.org, Apple DID NOT RESPOND to this on July 31, 2003. Other manufacturers CAME OUT WITH FIXES 10 days ago. Apple still buried their head in the sand.

[Salo]

I've already applied it. Thanks.

[Joy Angela]

I'm trying to make this easy to understand! The virus is set to start on Saturday, that's today, but hopefully someone is helped by these instructions.

So far, my computer seems to have recovered. It was shutting down and the virus is from using Windows, and not email related, from what I've read.

Good Luck!

Do these two steps, below to patch and scan for the virus

Link 1
http://vil.nai.com/vil/stinger/ go here to scan for virus


and then go here to download patch

Link 2
http://www.microsoft.com/downloads/details.aspx?FamilyId=2354406C-C5B6-44AC-9532-3DE40F69C074&displaylang=en



Lots of info in this freerepublic thread as well. Read all the pages.

AND FOR MORE INFO..
Read about the virus and see all four steps to counter the virus.
http://www.microsoft.com/security/incident/blast.asp

[rambo316]

Folks, if you don't know it, unplug your modem when you are not using your computer. What many people don't realize, is that even though you turn your computer off, your modem is still accessible if it is plugged in.

[onyx]

Thank you. Undoubedly, I will have questions for you later this morning --- on my way back to bed.

[Joy Angela]

By unplugging the modem, do you mean unplug the phone line?

What other ways can you unplug the modem?

Thanks!

[rambo316]

That is what I meant. Unplug that phone line going to your computer. Sorry that I was not clear on that. God Bless.