WORM_SASSER.D

[Marianna]

Virus type: Worm

Destructive: No

Description:



This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the infected system. This vulnerability is discussed in detail in the following pages:

MS04-011_MICROSOFT_WINDOWS
Microsoft Security Bulletin MS04-011
To propagate, it scans for vulnerable systems at TCP port 445 and sends a specially-crafted packet to produce a buffer overflow on LSASS.EXE. The packet runs a remote shell that opens port 9995. This worm commands the remote shell to download its copy from the original infected source via port 5554 using FTP.

More: http://www.trendmicro.com/vinfo/viru...=WORM_SASSER.D