full-disclosure - MSblast worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1060695870.25404.5.camel@boromir.infoserf.net>
From: robert at infoserf.net (Robert Lemos)
Subject: MSblast worm

On Tue, 2003-08-12 at 04:09, Johan Denoyer wrote:
> worms affects :
> 
> Microsoft Windows NT 4.0
> Microsoft Windows 2000
> Microsoft Windows XP
> Microsoft Windows Server 2003
>
> > Does anyone know if this MSblast worm affects Win NT machines, or is it
> > just
> > infecting 2000 and XP.

This is wrong, from everything that I've heard. The worm uses an exploit
that could affect those systems, but in reality it only has two offsets
for executable entry: One for Windows XP and another for Windows 2000. 

It does no OS checking but rather sends the exploit with the XP offset
80 percent of the time and the 2K offset the rest of the time.

So, is NT, 98, 2003 vulnerable? Not unless they have either of those
particular offsets in common with Windows XP and Windows 2K. However,
it's likely that such systems could crash.

-R

-- 
| robert lemos | technology journalist   |
| e: robert@...oserf.net | pgp: 12980B23 |