Recent Posts

Community

Email Notifications

Personal Links

Archives

Harry Waldron - IT Security

Security Developments, Software Updates and Best Practices

MS05-039: Zotob.A Internet Worm -- In-the-wild

  The Mytob worm has been modified to include MS05-039 exploitation. F-Secure gives this a MEDIUM RISK rating (2 of 3 on the Radar scale).

KEY LINKS

MS05-039: Zotob.A Worm - F-Secure (MEDIUM RISK)

MS05-039: Zotob.A Worm - F-Secure WEBLOG

MS05-039: Zotob.A Worm - F-Secure (MEDIUM RISK)

Zotob.A is a Mytob clone that spreads using a vulnerability in Windows Plug and Play service (MS05-039). Spreading using Plug and Play service vulnerability

The worm scans for systems vulnerable to Microsoft Windows Plug and Play service (MS05-039) through TCP/445. If the attack is successful, the worm instructs the remote computer to download and execute the worm from the attacker computer using
FTP. The FTP server listens on port 33333 on all infected computers with the purpose of serving out the worm for other hosts that are being infected. The downloaded file is saved as 'haha.exe' on disk.urity/Bulletin/MS05-039.mspx

Comments

TrackBack said:

# August 14, 2005 10:16 AM