WORM: Agobot Sasser FTP Overflow

This signature detects the Agobot worm attempting to access a system already infected by the Sasser worm. If this signature is detected in your network traffic, the target computer is most likely infected with the Sasser worm.

Extended Description

It has been reported that the Microsoft Windows Locator service is affected by a remotely exploitable buffer overflow vulnerability. The condition is due to a memory copy of RPC arguments received from remote clients into a local buffer. This vulnerability may be exploited by remote attackers to execute custom instructions on the target server. It is also possible to crash the service with a malicious request. It should be noted that, to exploit this vulnerability, no authentication is required. Additionally, the Locator service is enabled by default on all Windows 2000 and Windows NT Domain Controllers (DC).

Affected Products

Microsoft windows_nt_terminal_server

References

CVE: CVE-2003-0003

Short Name

WORM:AGOBOT:SASSER-FTP-OF

Severity

Major

Recommended

False

Recommended Action

Drop

WORM: Agobot Sasser FTP Overflow

Extended Description

Affected Products

References

Found a potential security threat?