r00t advisory -- Sunny Day Virus

[gahull () ccs neu edu (Gregory Hull)]

r00t VIRUS advisory                                     [ Sunny Day Virus ]

-- Synposis
This is the first known, widely distributed virus, for SunOS/Solaris
machines running on SPARCstations and SPARC clones.  The virus runs as root
and corrupts various critical kernel tables at seemingly random intervals.

The virus is believed to enter machines through various holes in sendmails
version 8.6.9 + (Including the 8.7.x line of sendmail).  Once having entered
a system the virus mutates as it infects each file.

-- Detecting the virus
The virus does leave noticeable trails.  At hourly intervals it will make a
random /usr/bin binary suid root.  Upon each chmod 4755 it performs the last
program it 4755'd will be restored to it's orginal permissions.

-- Removing the virus
r00t recommends a complete OS reinstallation.

-- Preventing the virus
The virus can be prevented by downgrading to a version of sendmail older than
8.6.9 or by not running sendmail at all.  As far as we've deteced so far, the
virus does not attempt to enter through any other remote services.


r00t -- giving it all away.