Security News

  1. MyDoom.B Virus

    Systems Affected

     

    Any system running Microsoft Windows (Windows 95 and newer) that are used for reading email or accessing peer-to-peer file sharing services.

     

    Overview

     

    A new variant of the previously discovered MyDoom virus, MyDoom.B, has been identified. In addition to the common traits of email-borne viruses, this virus may prevent your computer from updating anti-virus and other software.

     

    Description

     


     

    Quick Links
    Protect | Identify | Recover


    Protect Your Systems

    To protect your systems from infection by this virus, we recommend that you take the following steps. In addition to these steps, US-CERT encourages home users to review the "Home Network Security" and "Home Computer Security" documents.

    • Avoid opening attachments from suspicious email messages

    Emails sent out by Mydoom.B are generated randomly. The From address may also be spoofed to appear as though the message is from a different address.

    The subject of the message will include one of the following:

    • Delivery Error
    • hello
    • Error
    • Mail Delivery System
    • Mail Transaction Failed
    • Returned mail
    • Server Report
    • Status
    • Unable to deliver the message

    Not all email messages with these subject lines carry the MyDoom.B virus, some may be legitimate status messages.

    The message body will include one of the following:

    • RANDOMIZED CHARACTERS
    • test
    • The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
    • sendmail daemon reported: Error #804 occured during SMTP session. Partial message has been received.
    • The message contains Unicode characters and has been sent as a binary attachment.
    • The message contains MIME-encoded graphics and has been sent as a binary attachment.
    • Mail transaction failed. Partial message is available.

    The attachment will have one of the following filenames:

    • body
    • doc
    • text
    • document
    • data
    • file
    • readme
    • message

    The filename also contains an extension (.exe, .bat, .scr, .cmd, or .pif). When the attachment is opened, the MyDoom.B virus is launched and the system is infected.

    • Run and maintain an antivirus product

    It is important that you use antivirus software and keep it up to date. Most antivirus software vendors frequently release updated information, tools, or virus databases to help detect and recover from virus infections. Many antivirus packages support automatic updates of virus definitions. US-CERT recommends using these automatic updates when possible.

    You may wish to read CERT Incident Note IN-2003-01 for more information on anti-virus software and security issues.

    • Do not run programs of unknown origin

    Do not download, install, or run a program unless it was written by a person or company that you trust.

    Email users should be wary of unexpected attachments. Be sure you know the source of an attachment before opening it. Also remember that it is not enough that the mail originated from an email address you recognize. The Melissa virus spread precisely because it originated from a familiar email address.

    In addition, MyDoom.B attempts to spread through file-sharing services like KaZaA. Peer-to-peer file sharing users should be particularly careful of running software sent to them by other users. This is a commonly used method among intruders attempting to build networks of distributed denial-of-service (DDoS) agents.

    • Use a personal firewall

    A personal firewall will not necessarily protect your system from an email-borne virus, but a properly configured personal firewall may prevent the virus from downloading additional components or launching attacks against other systems.

    How to Identify a MyDoom.B Infection

    To confirm that your system has been infected with the MyDoom.B virus, perform the following steps.

    • Check the 'hosts' file

    MyDoom.B overwrites the Windows 'hosts' file. The file it replaces it with will probably prevent your system from accessing your antivirus vendor's web site as well as some other web sites. You can check your hosts file by following these steps:

    Windows NT/2000/XP Systems

    1. Click on the Start menu and select Run
    2. In the dialog box that appears, type cmd and hit OK (a DOS window should appear)
    3. At the prompt in the DOS window type type %windir%\system32\drivers\etc\hosts
    4. If you see multiple lines starting with 0.0.0.0, your system is probably infected


    Windows 95/98/Me Systems

    1. Click on the Start menu and select Run
    2. In the dialog box that appears, type command and hit OK (a DOS window should appear)
    3. At the prompt in the DOS window type type %windir%\hosts
    4. If you see multiple lines starting with 0.0.0.0, your system is probably infected
    • Check for files left by the virus

    MyDoom.B drops several files on an infected computer. The existence of these files is a good indication of infection. Be aware that thereare legitimate Windows files with names similar to those left by the virus. Only files with these names and in these specific directories indicate an infection.

    Windows NT/2000/XP Systems

    1. Click on the Start menu, select Search and then select For Files and Folders
    2. In the search box type explorer.exe
    3. The existence of explorer.exe in the System32 directory (typically C:\Windows\System32) is an indication of infection
    4. In the search box type ctfmon.dll
    5. The existence of ctfmon.dll in the System32 directory (typically C:\Windows\System32) is another indication of infection


    Windows 95/98/Me Systems

    1. Click on the Start menu, select Search
    2. In the search box type explorer.exe
    3. The existence of explorer.exe in the System directory (typically C:\Windows\System) is an indication of infection
    4. In the search box type ctfmon.dll
    5. The existence of ctfmon.dll in the System directory (typically C:\Windows\System) is another indication of infection
    • Examine the Windows Registry

    The MyDoom.B virus also makes some changes to the Windows registry. Users who are unfamiliar with the registry should probably skip this step because it may cause serious damage to the operating system if accidental changes are made.

    Windows 95/98/Me/NT/2000/XP Systems

    1. At a DOS command prompt, type regedit.exe (the registry editor should appear)
    2. Search the Registry for the value Explorer=C:\WINDOWS\system32\explorer.exe in the key HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    3. The existence of this value is an indication of MyDoom.B infection

    If Your System is Infected

    If your system is infected, you will probably be unable to access your antivirus vendor's web site for assistance due to some changes the virus has made to your system. If this is the case, follow these steps to delete a file installed by the virus (do not do this unless you are infected; it may affect the normal operation of your system):

    Windows NT/2000/XP Systems

    1. Click on the Start menu and select Run
    2. In the dialog box that appears, type del %windir%\system32\drivers\etc\hosts


    Windows 95/98/Me Systems

    1. Click on the Start menu and select Run
    2. In the dialog box that appears, type del %windir%\hosts

    After deleting this file, you should be able to access your antivirus vendor's web site, obtain the updates to your antivirus software and perform a full scan of your system. Some antivirus vendors may produce a Removal Tool and make it available on their web site. If your vendor provides such a tool, you may want to use it first.

    If you are still unsuccessful at removing the virus, contact your antivirus vendor to obtain further assistance with removal and recovery.

    Additional Information

    For additional technical details about this virus, please see US-CERT Technical Alert TA04-028A.html

    Copyright 2004 Carnegie Mellon University. Terms of use

    Revision History

    • January 28, 2004: Initial release
      January 30, 2004: Added formatting, revised content

      Last updated 

  2. Multiple Vulnerabilities in Microsoft Internet Explorer

    Systems Affected

     

    Microsoft Windows systems running

    • Internet Explorer 5.01
    • Internet Explorer 5.50
    • Internet Explorer 6

    Previous versions that are no longer supported may also be affected.

     

     

    Overview

     

    Microsoft Internet Explorer (IE) contains multiple vulnerabilities, the most serious of which could allow attackers in any location to run programs of their choice on your computer using the same privileges as you have.

    Quick Links

    Patch Information | Problem Description | References 

     

    Description

     

    Microsoft's Home User Security Bulletin for February 2004 describes three vulnerabilities in Internet Explorer (IE).

    Note that in addition to IE, any applications that use IE to interpret HTML documents, such as email programs, may present additional ways for these vulnerabilities to be used. 

    These vulnerabilities have different impacts, ranging from disguising the true location of a URL to executing computer commands or code, essentially taking over control of your computer and any data on it. The attacker could exploit this vulnerability by convincing you, the victim, to access a specially crafted HTML document such as a web page or HTML email message. Your computer can be compromised simply by viewing the attacker's HTML document with Internet Explorer. 

     

    A technical description of these vulnerabilities is available from US-CERT in TA04-033A and from Microsoft in MS04-004.

    Resolution

    Apply a patch

    Microsoft has released a home user bulletin describing how to determine what patches you will need and how to get them. Follow the procedures outlined in Microsoft's Home User Security Bulletin for February 2004.

    For additional information, and to receive updates on this alert, go to http://www.us-cert.gov.

    References

    • US-CERT Technical Alert TA04-033A - <http://www.us-cert.gov/cas/techalerts/TA04-033A.html>
    • Microsoft's Home User Security Bulletin for February 2004 - <http://www.microsoft.com/security/security_bulletins/20040202_windows.asp>
    • Microsoft Security Bulletin MS04-004 - <http://www.microsoft.com/technet/security/bulletin/MS04-004.asp>

    This document is available from <http://www.us-cert.gov/cas/alerts/SA04-033A.html>

    Copyright 2004 Carnegie Mellon University. Terms of use

    Revision History

    • February 02, 2004: Initial release

      Last updated 

  3. HTTP Parsing Vulnerabilities in Check Point Firewall-1

    Systems Affected

     
    • Check Point Firewall-1 NG FCS
    • Check Point Firewall-1 NG FP1
    • Check Point Firewall-1 NG FP2
    • Check Point Firewall-1 NG FP3, HF2
    • Check Point Firewall-1 NG with Application Intelligence R54
    • Check Point Firewall-1 NG with Application Intelligence R55


     

     

    Overview

     

    Several versions of Check Point Firewall-1 contain a vulnerability that allows remote attackers to execute arbitrary code with administrative privileges. This allows the attacker to take control of the firewall and the server it runs on.


     

     

    Description

     

    The Application Intelligence (AI) component of Check Point Firewall-1 is an application proxy that scans traffic for application layer attacks once it has passed through the firewall at the network level. Earlier versions of Firewall-1 include the HTTP Security Server, which provides similar functionality.

    Both the AI and HTTP Security Server features contain an HTTP parsing vulnerability that is triggered by sending an invalid HTTP request through the firewall. When Firewall-1 generates an error message in response to the invalid request, a portion of the input supplied by the attacker is included in the format string for a call to sprintf().

    Researchers at Internet Security Systems have determined that it is possible to exploit this format string vulnerability to execute commands on the firewall. The researchers have also determined that this vulnerability can be exploited as a heap overflow, which would allow an attacker to execute arbitrary code. In either case, the commands or code executed by the attacker would run with administrative privileges, typically "SYSTEM" or "root". For more information, please see the ISS advisory at:

    http://xforce.iss.net/xforce/alerts/id/162

    The CERT/CC is tracking this issue as VU#790771. This reference number corresponds to CVE candidate CAN-2004-0039.


    Impact

    This vulnerability allows remote attackers to execute arbitrary code on affected firewalls with administrative privileges, typically "SYSTEM" or "root".


    Solution

    Apply the patch from Check Point

    Check Point has published a "Firewall-1 HTTP Security Server Update" that modifies the error return strings used when an invalid HTTP request is detected. For more information, please see the Check Point bulletin at:

    http://www.checkpoint.com/techsupport/alerts/security_server.html

    Disable the affected components

    Check Point has reported that their products are only affected by this vulnerability if the HTTP Security Servers feature is enabled. Therefore, affected sites may be able to limit their exposure to this vulnerability by disabling HTTP Security Servers or the Application Intelligence component, as appropriate.

    This vulnerability was discovered and researched by Mark Dowd of ISS X-Force.

    This document was written by Jeffrey P. Lanza.

    This document is available from http://www.us-cert.gov/cas/techalerts/TA04-036A.html

    Revision History

    • 02/05/2004: Initial release
      02/06/2004: Updated Solution section
      02/06/2004: Updated Overview and Impact sections
       

      Last updated 

  4. Multiple Vulnerabilities in Microsoft Windows

    Systems Affected

     

    Systems running Microsoft Windows

     

    Overview

     

    Microsoft Windows contains multiple vulnerabilities, the most serious of which could allow attackers to take control of your computer.

     

    Description

     

    Microsoft's updated Home User Security Bulletin for February 2004 describes more vulnerabilities in the Microsoft Windows operating system. Microsoft is tracking these issues as Security Update 828028.

    It is unclear at this time how many different ways your computer can be compromised using these vulnerabilities, so we recommend you apply the updates below as soon as possible. A technical description of these vulnerabilities is available from US-CERT in TA04-041A and from Microsoft in MS04-007.

    Resolution

    Apply a patch

    Microsoft has released a home user bulletin describing how to determine what patches you will need and how to get them. Follow the procedures outlined in Microsoft's updated Home User Security Bulletin for February 2004.

    For additional information, and to receive updates on this alert, go to http://www.us-cert.gov/cas/alerts/SA04-041A.html

    References

    • US-CERT Technical Alert TA04-041A - <http://www.us-cert.gov/cas/techalerts/TA04-041A.html>
    • Microsoft's Updated Home User Security Bulletin for February 2004 - <http://www.microsoft.com/security/security_bulletins/20040210_windows.asp>
    • Microsoft Security Bulletin MS04-007 - <http://www.microsoft.com/technet/security/bulletin/MS04-007.asp>
    • Microsoft Knowledge Base Article 828028: An ASN.1 vulnerability could allow code execution - <http://support.microsoft.com/?kbid=828028>

    This document is available from <http://www.us-cert.gov/cas/alerts/SA04-041A.html>

    Copyright 2004 Carnegie Mellon University. Terms of use

    Revision History

    • February 10, 2004: Initial release

      Last updated 

  5. Vulnerability in Microsoft Outlook 2002

    Systems Affected

     

    Systems running Microsoft Office XP and Outlook 2002

     

    Overview

     

    There is a vulnerability in Outlook 2002 that could allow attackers to take control of your computer.

     

    Description

     

    By taking advantage of the way Outlook interprets email links, an attacker may be able to gain control of your computer.

    A technical description of these vulnerabilities is available from US-CERT in TA04-070A and from Microsoft in MS04-009.

    Resolution

    Apply a patch

    Microsoft's Office Security Update for March 2004 links to the necessary patches.

    References

    • US-CERT Technical Alert TA04-070A - <http://www.us-cert.gov/cas/techalerts/TA04-070A.html>
    • Microsoft's Office Security Update for March 2004 - <http://www.microsoft.com/security/security_bulletins/20040309_office.asp>
    • Microsoft Security Bulletin MS04-009 - <http://www.microsoft.com/technet/security/bulletin/ms04-009.mspx>

    This document is available from <http://www.us-cert.gov/cas/alerts/SA04-070A.html>

    Copyright 2004 Carnegie Mellon University. Terms of use

    Revision History

    • March 10, 2004: Initial release

      Last updated