|
|
Exploit code is circulating fast
|
02-17-04
(Philadelphia & Conshohocken, PA)
(Philadelphia & Conshohocken, PA)
Security researchers say code designed to exploit a recently announced critical vulnerability in Microsoft operating systems now is widespread on the Internet.
The code crashes targeted computers by exploiting a flaw in Microsoft's Abstract Syntax Notation 1 Library in Windows NT, 2000 and XP. The exploit code was discovered Saturday, February
14, four days after the vulnerability and a patch to correct it was announced by Microsoft. The code is available on several discussion groups and Web sites.
Ken Dunham of iDefense Inc. said there have been reports of denial-of-service attacks against specific targets using this exploit, but the attacks are not yet widespread. "It may be a few days before we see
anything beyond a DOD attack," he said.
"Several attackers are actively working on an ASN.1 exploit to spread Trojans and 'bots. One attacker has
expressed an interest in creating a worm that will 'take down the Internet.”
Dunham said the malicious actors are capable of "weaponizing" the exploit, but have so far had little success in their tests.
In other malicious-code news, Symantec Corporation has raised the security level for the new Welchia worm because of increasing numbers of infections. Welchia, also known as Nachi, first appeared last August in the wake of the MSBlaster worm.
It automatically patched against the vulnerability exploited by Blaster. The new version, Welchia.b, appears to remove the MyDoom a and b worms from infected machines. Once installed on a machine, it tries
successively to exploit three vulnerabilities against a random IP address.
BACK to the Netforcement News Page.
REQUEST MORE INFORMATION On how Netforcement can help you secure the integrity of your network.
|
|
