Video | Business Headlines | Internet | Science | Scientific Ethics | Technology | Search

 

Symantec Security Response - New Worm - Level 3

UPDATE: 13th August 2003:
RE: Microsoft New Zealand

Note to Editor:

If you are covering this security issue, Microsoft would appreciate that you use the following URLs and Phone numbers rather than any previously issued.
Phone: 0800 800 004.
Website: http://www.microsoft.com/security

Thank you for your assistance.

Megan Rosier
AUGUST.ONE COMMUNICATIONS

Symantec Security Response - New Worm - Level 3 (Moderate)

Symantec Security Response has identified a new Level 3 worm in the wild -- W32.Blaster.Worm -- that is exploiting the Microsoft DCOM RPC Interface Buffer Overrun vulnerability. Due to the high number of users impacted by this vulnerability, Symantec has raised the ThreatCon to a Level 3. Systems affected include Microsoft IIS, Windows 2000, Windows XP and Windows NT.

W32.Blaster.Worm uses the DCOM MSRPC vulnerability to compromise a remote system. It attempts to connect to TCP port 4444 after the attack and then uses tftp to retrieve and install a copy of itself onto the infected system.

When the W32.Blaster.Worm is executed, it will do the following:

1. Adds the value: "windows auto update"="msblast.exe" to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the worm runs when you start Windows.

2. Send data on TCP port 135 that may exploit the DCOM RPC vulnerability to allow the following actions to occur on vulnerable machines: the worm will be downloaded and will run using the program tftp.

Through analysis of the worm, Symantec has determined that it contains code to launch a Denial-of-Service attack against windowsupdate.com during a specific time period. The worm will launch a Denial-of-Service attack after August 15th through the end of the year, every year.

Through Symantec's DeepSight Threat Management System, Symantec has identified that over 57,000 systems have been infected and are currently launching probes against Port 135.

This number has grown exponentially in the last 24 hours as the average was 1000 - 2000 as of August 10th. Symantec's Managed Security Services reports that W32.Blaster.Worm is propagating at a rate of roughly 20% that of the Slammer worm, in terms of instances of infection (unique IP addresses) per hour passing through our client's security devices.

Microsoft issued a patch for this vulnerability on July 16th. Symantec Security Response strongly encourages users to patch systems. The patch is available at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/ bulletin/MS03-026.asp

More information on this worm and how to delete and scan for infected files can be found on the Symantec Security Response website http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html


© Scoop Media

 
 
 
Business Headlines | Sci-Tech Headlines

 

Forest & Bird: Report Find Council Failures On Effluent

The report exposes significant inconsistencies and gaps in how regional councils are enforcing the rules around dairy effluent management. More>>

ALSO:

Mana In Mahi: Helping Young New Zealanders Into Work

Thousands of young people will be given the chance to gain valuable qualifications and meaningful work under the Mana in Mahi – Strength in Work scheme launched by Prime Minister Jacinda Ardern today. More>>

ALSO:

Reserve Bank: Official Cash Rate Unchanged At 1.75 Percent

The Official Cash Rate (OCR) remains at 1.75 percent. We expect to keep the OCR at this level through 2019 and into 2020, longer than we projected in our May Statement. The direction of our next OCR move could be up or down. ... More>>

Post-Cabinet Press Conference: Trade Stuff

Jacinda Ardern and David Parker's press conference that focused on the government's 'trade for all agenda' plans for widespread consultation on the shape of future trade agreements... More>>

ALSO:

Debt Capital Markets Summit: Grant Robertson On The Economy

"In short, the heart of our Government’s economic plan is to help New Zealand become a more productive, more sustainable, and more inclusive economy in which all New Zealanders can thrive." More>>

ALSO:

Best Environment Practice For Landcorp Farms: New Forest & Bird And Pāmu Collaboration

New Zealand’s largest conservation organisation and largest farming group have agreed to work together to promote best environmental practice in New Zealand’s farming sector. More>>