TROJAN: MyDoom.AH HTTP Infection

This signature detects MyDoom.AH/Bofra.B and similar variants attempting to infect a new host using the Internet Explorer IFRAME name overflow vulnerability. MyDoom.AH runs a Web server on port 1639; when a client connects and requests a page, MyDoom.AH sends the malicious payload to the host.

Extended Description

Microsoft Internet Explorer is reported prone to a remote buffer overflow vulnerability. This issue presents itself due to insufficient boundary checks performed by the application and results in arbitrary code execution or a denial of service. This issue does not affect the following Internet Explorer 6 versions: - Internet Explorer 6 for Windows Server 2003 - Internet Explorer 6 for Windows Server 2003 64-Bit Edition and Windows XP 64-Bit Edition Version 2003 - Internet Explorer 6 for Windows XP Service Pack 2

Affected Products

Avaya s8100_media_servers,Avaya modular_messaging

References

BugTraq: 11515

CVE: CVE-2004-1050

URL: http://vil.nai.com/vil/content/v_129631.htm http://www.cert.org/incident_notes/IN-2004-01.html

Short Name

TROJAN:MYDOOM:AH-HTTP-INFECT

Severity

Major

Recommended

False

Recommended Action

Drop

TROJAN: MyDoom.AH HTTP Infection

Extended Description

Affected Products

References

Found a potential security threat?