Re: Would a firewall prevent Sasser worm?

From: zz (zz_at_nospam.com)
Date: 05/04/04 

Date: Tue, 04 May 2004 10:52:38 GMT

Lars M. Hansen wrote:
> On Tue, 04 May 2004 08:33:32 GMT, Piotr Makley spoketh
>
>
>>If I had a firewall would that prevent the Sasser worm infecting my
>>PC?
>>
>>I mean, if another infected system cannot see my ports because they
>>are stealthed then presumably Sasser could not infect me?
>
>
> Yes, any firewall that blocks incoming port 445 will prevent infection
> by the Sasser worm.
>
> Lars M. Hansen
> http://www.hansenonline.net
> (replace 'badnews' with 'news' in e-mail address)

 From Microsoft: "Customers who have enabled the Windows XP Firewall are
protected from the vector this worm attacks, which is TCP Port 139.
Most third party firewalls also block this attack vector by default."

g-w

Relevant Pages

  • Re: Would a firewall prevent Sasser worm?
    ... ]>]>If I had a firewall would that prevent the Sasser worm infecting my ... any firewall that blocks incoming port 445 will prevent infection ...
    (comp.security.misc)
  • Re: Would a firewall prevent Sasser worm?
    ... ]>]>If I had a firewall would that prevent the Sasser worm infecting my ... any firewall that blocks incoming port 445 will prevent infection ...
    (comp.security.firewalls)
  • Re: Would a firewall prevent Sasser worm?
    ... ]>]>If I had a firewall would that prevent the Sasser worm infecting my ... any firewall that blocks incoming port 445 will prevent infection ...
    (alt.computer.security)
  • Re: Would a firewall prevent Sasser worm?
    ... >>If I had a firewall would that prevent the Sasser worm infecting my ... any firewall that blocks incoming port 445 will prevent infection ... protected from the vector this worm attacks, which is TCP Port 139. ...
    (comp.security.firewalls)
  • Re: Would a firewall prevent Sasser worm?
    ... >>If I had a firewall would that prevent the Sasser worm infecting my ... any firewall that blocks incoming port 445 will prevent infection ... protected from the vector this worm attacks, which is TCP Port 139. ...
    (comp.security.misc)