Alert: Worm Sasser.A

NeonWizard · May 1, 2004

As of May 1, 2004 4:15 AM (PST), TrendLabs has declared a Yellow alert to control the spread of this malware. Infection reports have been received from Europe, Asia and the US.

This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system.

Apply patch if you did not update from Microsoft lately
Microsoft Security Bulletin for April 2004

Windows Update

Worm Sasser.A

The virus was discovered May 1, 2004 and it already infected over 1,271 computers. Please patch your Windows if you did not yet do so.

Randy_Bell · May 1, 2004

Received this morning:

Dear Trend Micro customer,

As of May 1, 2004 4:15 AM PST, TrendLabs has declared a Medium Risk Virus Alert to control the spread of WORM_SASSER.A.
TrendLabs has received several infection reports indicating that this malware is spreading in the US.

This worm is known to exploit the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system. This vulnerability is discussed in detail in the following pages:

. http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=MS04-011_MICROSOFT_WINDOWS
. http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

To propagate, it scans random IP addresses for vulnerable systems. When a vulnerable system is found, the malware sends a specially crafted packet to produce a buffer overflow on LSASS.EXE.

The resulting overflow allows the malware to listen to TCP port 9996, which instructs it to spawn a command shell. The malware then creates the script file CMD.FTP that contains instructions for the vulnerable system to download and execute a copy of this malware via FTP.

The infected host then opens TCP port 5554 to accept any FTP requests from infected remote systems. The worm copy to be downloaded bears the file name, <random integer>_up.exe (e.g., 12345_up.exe), and is saved in the Windows system directory.

After download, the malware deletes the file CMD.FTP. A log file named WIN.LOG is created in the root directory. This file contains the number of remote systems that the host system were able to infect.

TrendLabs will be releasing the following EPS deliverables:

TMCM Outbreak Prevention Policy 110 (released)
Official Pattern Release 879 (released)
Damage Cleanup Template 331 (ETA 1 hour)
Vulnerability Assessment Rule 10 (released)
NVW Pattern 10124 (ETA 1 hour)

For more information on WORM_SASSER.A, you can visit our Web site at:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SASSER.A.
Click to expand...

Log in or Sign up

Alert: Worm Sasser.A

NeonWizard Registered Member

Randy_Bell Registered Member

Log in or Sign up

Alert: Worm Sasser.A

NeonWizard Registered Member

Randy_Bell Registered Member

Useful Searches