Re: JPEG Virus Now in the Wild
From: Charles Otstot (saries_at_notmyreal.address.com)
Date: 09/30/04
- Next message: Charles Otstot: "Re: I have Been Fooled , Bamboozeled, Hoodwinked. What Happend????"
- Previous message: Joost: "Norton Anti-Virus Not recognised by windows security"
- In reply to: Tom Pepper Willett: "JPEG Virus Now in the Wild"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 30 Sep 2004 08:52:43 -0400
"Tom Pepper Willett" <tompepper@mvps.org> wrote in message
news:uQ1diVVpEHA.2864@TK2MSFTNGP12.phx.gbl...
> I just recieved this on my IMAIL List....
>
> Tom Pepper Willett
> Microsoft MVP - FrontPage
> --------------
>
> For the first time ever, a JPEG virus in now in the wild. This is the
> problem that everyone had been dreading for years. It is now possible for
> a machine that is behind an extremely secure firewall to receive a virus
> simply by going to a website (even some legitimate websites, such as
eBay),
> or previewing an E-mail.
>
> http://www.easynews.com/virus.txt has details on the virus that was just
> released.
>
> Now is the time to patch every computer that you can (if possible -- some
> programs with the GDIPlus.dll vulnerability are from companies that are
now
> out of
> business).
> http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx is one
> place to start.
>
The "report" from easynews isn't entirely accurate. Their reported "virus"
really isn't. It has no replication mechanism and can only "infect" the
system used to run the exploit code.
It was simply acting as a dropper for using the GDI exploit to set up IRC
FTP servers (along with the requisite remote control application...RAdmin in
this case). It basically entailed the FXP script kiddies bolting the exploit
onto existing toolsets to open a new vector so that they can run their IRC
servers and play with new toys.
This isn't meant to minimize the vulnerability or the need to patch. I
simply wanted to clarify the info posted by easynews so that this particular
report doesn't get overhyped.
Charlie
>
>
- Next message: Charles Otstot: "Re: I have Been Fooled , Bamboozeled, Hoodwinked. What Happend????"
- Previous message: Joost: "Norton Anti-Virus Not recognised by windows security"
- In reply to: Tom Pepper Willett: "JPEG Virus Now in the Wild"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
