A Bugtraq user has already pointed out that a worm has been discovered in the wild that exploits the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (Bugtraq ID 8205) to infect host systems. Symantec has been tracking its activity and is currently conducting analysis/full disassembly of the malicious code, which has been named "Blaster". The results of our analysis are being made available to the public at the following location:

https://tms.symantec.com/members/Ana...t-DCOMworm.pdf

It is expected that this report will be updated frequently as more information is discovered. Readers are advised to download/refresh it throughout the day to ensure that any new information is not missed.

David Mirza Ahmad
Symantec

W32.Mimail.A@mm is a worm that spreads by email and steals information from a user's machine. The email has the following characteristics:

Subject: your account [random string]
Attachment: message.zip


The threat captures information from certain windows on a user's desktop and emails it to specific mail addresses.
This threat takes advantage of known vulnerabilities: MS02-15 and MS03-14. A Microsoft patch is located at: http://www.microsoft.com/windows/ie/...4/default.asp.
We encourage system administrators to apply the Microsoft patch to prevent infection by this worm.
The worm is packed with UPX.

Originally posted by IS2Scooby
P.S. DON'T get caught with your pants down!
P.P.S. If you do, I make house calls for $50/hr.

Internet Security Systems Security Alert
August 11, 2003

"MS Blast" MSRPC DCOM Worm Propagation

Synopsis:

ISS X-Force has captured active samples of an automated Internet worm that
propagates via the MS RPC DCOM vulnerability documented in ISS X-Force
Alert titled "Flaw in Microsoft Windows RPC Implementation"
(http://xforce.iss.net/xforce/alerts/id/147). MS Blast is currently
propagating aggressively across the Internet.

Impact:

Any vulnerable desktop or server connected to the Internet may be
vulnerable to attack. All Windows 2000, Windows XP and Windows NT 4.0
computers that have not been patched are vulnerable to attack from the
automated worm, or manual attack. X-Force believes that hundreds of
thousands of computers may still be vulnerable. Unsuccessful propagation
attempts may crash vulnerable computers, or render them unstable.
Successful worm outbreaks have been known to cause significant localized
network latency, and widespread denial of service.

Description:

The MS Blast worm propagates by exploiting the vulnerability described
in Microsoft Security Bulletin MS03-026, titled, "Buffer Overrun In RPC
Interface Could Allow Code Execution". The worm exhibits the following
behaviors:

Spawn a new thread, checks system clock and launches a TCP-based denial
of service attack at windowsupdate.com if the date is on or after
the 16th.

Add itself to registry so the worm restarts upon a reboot.

Initializes the attack vector for Windows 2000 or Windows XP based on a
simple mathematical calculation. Each infected instance will only attack
Windows XP or Windows 2000. One out of five worm infections will attack
windows 2000, and the remaining four will target Windows XP.

There is a 40% probability that the worm picks a random IP and then scans
sequentially from the starting point. There is a 60% probability that
the worm scans sequentially from its own IP address.

If a vulnerable machine is found, the exploit is launched and the newly
infected machine connects back to the scanning machine via TFTP to obtain
the worm binary. The binary is executed and the process begins again.

Recommendations:

X-Force recommends that network operators monitor TCP port 135 and UDP
port 69 traffic on their networks. The worm will generate TCP port 135
traffic in its attempts to propagate and UDP port 69 traffic in attempts
to download the worm binary on newly infected computers.

Originally posted by IS2Scooby
CLICK ME 2 BE SAFER for y'all lazy buggahs.

Originally posted by palaban
Thanks for the heads up.


Very easy to mis-quote, but I'd rather not.

Originally posted by IS2Scooby
P.S. DON'T get caught with your pants down!
P.P.S. If you do, I make house calls for $50/hr.