|
Description:
This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of affected systems. This vulnerability is discussed in detail in the following pages:
Upon execution, it drops a copy of itself in the Windows folder as AVSERVE2.EXE.
Note that its previous counterpart, WORM_SASSER.A, uses the file name AVSERVE.EXE for its copy.
Unlike the previous variant that only creates one mutex named Jobaka3l, this SASSER variant creates the following mutex instead:
If an instance of JumpallsNlsTillt is found on a system, this malware does not proceed with its execution.
To propagate, this worm sends a specially-crafted packet to TCP port 445 of random IP addresses. However it skips certain RFC 1918-reserved addresses. The packet causes a buffer overrun on vulnerable systems, which results in the execution of a remote shell that opens port 9996. This worm commands the remote shell to download its copy from the original infected source via port 5554 using FTP.
This worm can cause LSASS to crash and force Windows to restart. In this case, the following message boxes may appear:
Important: Trend Micro advises users to apply the critical patch related to the Windows LSASS vulnerability, which is available at the following Microsoft page:
Notes on Windows 2003 Server:
- Analysis and tests done on this malware show that it can execute and create registry entries on Windows 2003 server, but it fails to exploit the LSASS service in the said operating system version.
- Although Microsoft reports that the Windows 2003 Server is also vulnerable to the LSASS exploit, there may exist a code error within the malware exploit packet that prevents it from exploiting the LSASS vulnerability on the said platform.
The following article provides a thorough look into the different events that shaped Sasser's emergence and gives an extensive discussion about its implications:
For additional information about this threat, see:
Solution
Technical Details
Description created: May. 1, 2004 12:39:05 PM GMT -0800
Description updated: May. 6, 2004 5:20:01 AM GMT -0800
Search a new malware
Tell us how we did. Take our quick survey.
|
Save & Share
