full-disclosure - re: First Report : New Blaster?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200404230953.03118.jstewart@lurhq.com>
From: jstewart at lurhq.com (Joe Stewart)
Subject: re: First Report : New Blaster?

On Friday 23 April 2004 9:15 am, Willem Koenings wrote:
> > Heya folks. Can I claim possible new Blaster type execution on
> > Windows XP SP2 (Buid v. 2096)? Nothing reported by major vendors,
> > but ...
>
> I don't think so. Beside MS04-007 ASN.1 Remote DoS Exploit, there is
> worm called Sepuc. It uses multistage infection method via IE/chm
> and injects two dll files to lsass process space thus causing lsass
> to crash.

Sepuc actually injects four dlls into lsass in two stages, but I don't 
see lsass crashing because of this. However, the THCIISSLame exploit 
can crash the lsasrv module in lsass. Normally this just leads to a 
system error message saying LsaSrv will be disabled, but I'd suspect a 
total lsass.exe crash (and resulting system shutdown) could be caused 
on some platforms. We're already seeing this exploit widely used even 
though there is only one target offset - meaning some successful 
exploits, but mostly LsaSrv crashes will result.

-Joe

-- 
Joe Stewart, GCIH 
Senior Security Researcher
LURHQ http://www.lurhq.com/