WORM: Sasser A/B/C/D/F Backdoor Command (9995/6)

This signature detects successful connection attempts to a Sasser.A, B, C, D, or F backdoor shell running on port 9996. Sasser uses the connection to download the Sasser worm from the attacker to the newly exploited target. If this signature is detected, the destination machine (the target) was successfully exploited with the LSASS vulnerability, but it is not yet infected by the worm. To prevent the worm from installing on the target, configure a rule to drop all traffic that matches this Attack Object.

Extended Description

Stack-based buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code via a packet that causes the DsRolerUpgradeDownlevelServer function to create long debug entries for the DCPROMO.LOG log file, as exploited by the Sasser worm.

Affected Products

Microsoft windows_98

References

BugTraq: 10108

CVE: CVE-2003-0533

URL: http://secunia.com/virus_information/9142/sasser/ http://www.lurhq.com/sasser.html http://www.kb.cert.org/vuls/id/753212

Short Name

WORM:SASSER:A-D-F-SHELL-CMD

Severity

Major

Recommended

False

Recommended Action

Drop

WORM: Sasser A/B/C/D/F Backdoor Command (9995/6)

Extended Description

Affected Products

References

Found a potential security threat?