WORM_SASSER.A (PC1-2004-0447)

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                        AL-2004.14 -- AUSCERT ALERT
                               WORM_SASSER.A
                    Trend Micro Medium Risk Virus Alert
                                02 May 2004

Last Revised: 03 May 2004

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:                Windows 2000
                        Windows XP
Publisher:              Trend Micro
Impact:                 Administrator Compromise
Access Required:        Remote
CVE Names:              CAN-2003-0533

Ref:                    AU-2004.009
                        ESB-2004.0266

Comment:

Further information is available from the following sources, as listed
below.

 - http://www.microsoft.com/technet/security/alerts/sasser.mspx
 - http://www3.ca.com/threatinfo/virusinfo/virus.aspx?ID=39012
 - http://www.f-secure.com/v-descs/sasser.shtml
 - http://www.lurhq.com/sasser.html
 - http://www.sophos.com/virusinfo/articles/sasser.html
 - http://www.symantec.com/avcenter/venc/data/w32.sasser.worm.html
 - http://vil.nai.com/vil/content/v_125007.htm

- ---------------------------BEGIN INCLUDED TEXT--------------------

As of May 1, 2004  4:15 AM PST, TrendLabs has declared a Medium Risk Virus 
Alert to control the spread of WORM_SASSER.A. TrendLabs has received 
several infection reports indicating that this malware is spreading in the 
US.

This worm is known to exploit the Windows LSASS vulnerability, which is a 
buffer overrun that allows remote code execution and enables an attacker 
to gain full control of the affected system. This vulnerability is 
discussed in detail in the following pages: 

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=MS04-011_MICROSOFT_WINDOWS
http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx

To propagate, it scans random IP addresses for vulnerable systems. When a
vulnerable system is found, the malware sends a specially crafted packet 
to produce a buffer overflow on LSASS.EXE. 

The resulting overflow allows the malware to listen to TCP port 9996, 
which instructs it to spawn a command shell. The malware then creates the 
script file CMD.FTP that contains instructions for the vulnerable system 
to download and execute a copy of this malware via FTP. 

The infected host then opens TCP port 5554 to accept any FTP requests from 
infected remote systems. The worm copy to be downloaded bears the file
 name, <random integer>_up.exe (e.g., 12345_up.exe), and is saved in the 
Windows system directory. 

After download, the malware deletes the file CMD.FTP. A log file named
WIN.LOG is created in the root directory. This file contains the number of 
remote systems that the host system were able to infect. 


TrendLabs will be releasing the following EPS deliverables:

   TMCM Outbreak Prevention Policy 110 (released)
   Official Pattern Release 879 (released)
   Damage Cleanup Template 331 (ETA 1 hour)
   Vulnerability Assessment Rule 10 (released)
   NVW Pattern 10124 (ETA 1 hour)
  

For more information on WORM_SASSER.A, you can visit our Web site at:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SASSER.A.

- ---------------------------END INCLUDED TEXT--------------------

This alert is provided as a service to AusCERT's members.  As AusCERT did
not write the document quoted above, AusCERT has had no control over its   
content. The decision to follow or act on information or advice contained in
this security bulletin is the responsibility of each user or organisation, and 
should be considered in accordance with your organisation's site policies and 
procedures. AusCERT takes no responsibility for consequences which may arise 
from following or acting on information or advice contained in this security 
bulletin.

NOTE: This is only the original release of the alert.  It may not be
updated when updates to the original are made.  If downloading at a later
date, it is recommended that the alert is retrieved directly from the
author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the alert above.  If you have any questions or need further information,
please contact them directly.

Previous advisories, alerts and external security bulletins can be 
retrieved from:

        http://www.auscert.org.au/render.html?cid=1977

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business
                hours which are GMT+10:00 (AEST).  On call after hours
                for member emergencies only.