bugtraq - DCOM worm analysis report: W32.Blaster.Worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.55.0308111533340.32601@mail.securityfocus.com>
Date: Mon, 11 Aug 2003 15:36:24 -0600 (MDT)
From: Dave Ahmad <da@...urityfocus.com>
To: bugtraq@...urityfocus.com
Subject: DCOM worm analysis report: W32.Blaster.Worm

A Bugtraq user has already pointed out that a worm has been
discovered in the wild that exploits the Microsoft Windows DCOM RPC
Interface Buffer Overrun Vulnerability (Bugtraq ID 8205) to infect
host systems.  Symantec has been tracking its activity and is
currently conducting analysis/full disassembly of the malicious code,
which has been named "Blaster".  The results of our analysis are
being made available to the public at the following location:

https://tms.symantec.com/members/AnalystReports/030811-Alert-DCOMworm.pdf

It is expected that this report will be updated frequently as more
information is discovered.  Readers are advised to download/refresh
it throughout the day to ensure that any new information is not missed.

David Mirza Ahmad
Symantec

PGP: 0x26005712
8D 9A B1 33 82 3D B3 D0 40 EB  AB F0 1E 67 C6 1A 26 00 57 12
--
The battle for the past is for the future.
We must be the winners of the memory war.