WORM: Apache Slapper (C2) Worm Infection

This signature detects interactive traffic created by the Slapper worm. Apache systems with mod_ssl running on Linux are vulnerable. The Slapper worm uses an invalid HTTP GET request on TCP/80 to scan for vulnerable systems; when found, the worm uses TCP/443 to connect to the SSL service and exploit the system. The worm also copies its source code to the system, which the attacking system compiles and runs; infected systems scan for hosts to continue worm propagation. Finally, the infected system opens a backdoor on UDP/1812 and sends packets to the attacker.

Extended Description

OpenSSL is prone to a buffer-overflow vulnerability involving overly long SSLv3 session IDs. Reportedly, when an oversized SSLv3 session ID is supplied to a client from a malicious server, a buffer may overflow on the remote system. Key memory areas on the vulnerable remote system may be overwritten, and arbitrary code may run as the client process.

Affected Products

Hp jetdirect,Hp tcp/ip_services_for_openvms,Openssl_project openssl

References

BugTraq: 5362

CVE: CVE-2002-0656

URL: http://securityresponse.symantec.com/avcenter/venc/data/linux.slapper.worm.html http://vil.nai.com/vil/content/v_99693.htm http://www.f-secure.com/v-descs/slapper.shtml

Short Name

WORM:SLAPPER:C2-INFEC

Severity

Critical

Recommended

False

Recommended Action

Drop

WORM: Apache Slapper (C2) Worm Infection

Extended Description

Affected Products

References

Found a potential security threat?