RE: What the heck is this msblast.exe

I agree that the vulnerability is critical, but this classification refers to the worm exploiting it.

Earlier exploits have not been as widespread as this worm is, and have been classified as low. We could not classify malware based on the risk assessment of the vulnerability alone - otherwise they would all be 'critical', and that is simply not accurate.

AVERT can and will change the risk assessment as and when required.

For more information about the AVERT RA, see:

http://www.avertlabs.com

Lee Fisher
Solutions Architect
McAfee Product Management

-----Original Message-----
From: Rod Trent
To: Fisher, Lee; morris_minchu@iwon.com; focus-ms@securityfocus.com Sent: 11/08/03 15:44
Subject: RE: What the heck is this msblast.exe

Medium???? That's an irresponsible rating, considering that both MS and the
Department of Homeland Security have listed the vulnerability as critical.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

-----Original Message-----
From: Lee_Fisher@NAI.com [mailto:Lee_Fisher@NAI.com] Sent: Monday, August 11, 2003 6:27 PM
To: morris_minchu@iwon.com; focus-ms@securityfocus.com Subject: RE: What the heck is this msblast.exe

>From your description I would imagine it to be the Blaster ( We called
it
W32/Lovsan.worm )

Many posts on forums - We list it as a Medium On Watch alert - other AV orgs
have a similar classification.

http://vil.nai.com/vil/content/v_100547.htm

Lee Fisher
Solutions Architect
McAfee Product Management

-----Original Message-----
From: Minchu Mo
To: focus-ms@securityfocus.com
Sent: 11/08/03 15:00
Subject: What the heck is this msblast.exe

The code resides in c:\winnt\system32.

It somehow change my registry and pretend to be Window autoupdate in

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

\Localsystem\software\microsoft\window\run, so it can run when I boot the

machine. Now it sending out packet to random(?)IP 's endpoint port

---
Your network firewall and IDS products do not prevent Web application
attacks - the most common form of online exploitation- resulting in Web
defacement, data theft, sabotage and fraud.
KaVaDo is the only company that provides a complete suite of Web
application
security products.
Download a FREE whitepaper on "Security Policy Automation for Web
Applications":
http://www.securityfocus.com/Kavado-focus-ms
------------------------------------------------------------------------
---



------------------------------------------------------------------------
---
Your network firewall and IDS products do not prevent Web application
attacks - the most common form of online exploitation- resulting in Web
defacement, data theft, sabotage and fraud.
KaVaDo is the only company that provides a complete suite of Web
application
security products.
Download a FREE whitepaper on "Security Policy Automation for Web
Applications":
http://www.securityfocus.com/Kavado-focus-ms
------------------------------------------------------------------------
---



---------------------------------------------------------------------------
Your network firewall and IDS products do not prevent Web application 
attacks - the most common form of online exploitation- resulting in Web 
defacement, data theft, sabotage and fraud.
KaVaDo is the only company that provides a complete suite of Web 
application security products.
Download a FREE whitepaper on "Security Policy Automation for Web
Applications":
http://www.securityfocus.com/Kavado-focus-ms
---------------------------------------------------------------------------