Thanks to Harry Waldron for the alert on this threat.
Recently I mentioned on this blog that the Microsoft GDI+ Library JPEG Segment Length Integer Underflow vulnerability described in Microsoft Security Bulletin MS04-028. Now we have the first example of a non-proof of concept use of this vulnerability with the Moo Trojan.
Moo is a simple Trojan horse which has no functionality other than to download the file m00.exe from a web server and run it. It is unknown what m00.exe is, although chances are it is a backdoor program that allows unauthorized access to infected computers.
This has been labeled as the first Trojan horse to be found “in the wild” using this method. While technically true, it must be understood that “in the wild” simply means that the threat was found after it was released, and was not just directly submitted to antivirus companies. This does not necessarily mean that this threat is spreading significantly and, in fact, there have been no or few reports of Moo so far.
It is unlikely Moo will become a major threat in the field, especially as it is unable to spread by itself. Incorporating methods used in Moo could later result in much more dangerous worms, so it is important to watch this threat and patch all systems that could be affected. Also important to note is that this is not a virus and does not infect files; rather, it is a Trojan horse that downloads a file from a web server.
More information about Moo from Symantec is available here.
Posted
Sep 28 2004, 09:04 PM
by
trafton