A Bugtraq user has already pointed out that a worm has been discovered in the wild that exploits the Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability (Bugtraq ID 8205) to infect host systems. Symantec has been tracking its activity and is currently conducting analysis/full disassembly of the malicious code, which has been named "Blaster". The results of our analysis are being made available to the public at the following location: https://tms.symantec.com/members/AnalystReports/030811-Alert-DCOMworm.pdf It is expected that this report will be updated frequently as more information is discovered. Readers are advised to download/refresh it throughout the day to ensure that any new information is not missed. David Mirza Ahmad Symantec PGP: 0x26005712 8D 9A B1 33 82 3D B3 D0 40 EB AB F0 1E 67 C6 1A 26 00 57 12 -- The battle for the past is for the future. We must be the winners of the memory war. --------------------------------------------------------------------------- ----------------------------------------------------------------------------
This archive was generated by hypermail 2b30 : Mon Aug 11 2003 - 15:48:28 PDT