Full Disclosure mailing list archives
Re: MSblast worm
From: Robert Lemos <robert () infoserf net>
Date: Tue, 12 Aug 2003 06:44:30 -0700
On Tue, 2003-08-12 at 04:09, Johan Denoyer wrote:
worms affects : Microsoft Windows NT 4.0 Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003Does anyone know if this MSblast worm affects Win NT machines, or is it just infecting 2000 and XP.
This is wrong, from everything that I've heard. The worm uses an exploit that could affect those systems, but in reality it only has two offsets for executable entry: One for Windows XP and another for Windows 2000. It does no OS checking but rather sends the exploit with the XP offset 80 percent of the time and the 2K offset the rest of the time. So, is NT, 98, 2003 vulnerable? Not unless they have either of those particular offsets in common with Windows XP and Windows 2K. However, it's likely that such systems could crash. -R -- | robert lemos | technology journalist | | e: robert () infoserf net | pgp: 12980B23 | _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- MSblast worm Jasper Blackwell (Aug 12)
- Re: MSblast worm Johan Denoyer (Aug 12)
- Re: MSblast worm Matthew Murphy (Aug 12)
- Re: MSblast worm Robert Lemos (Aug 12)
- Re: MSblast worm Simon Glassman (Aug 12)
- Re: MSblast worm Nick FitzGerald (Aug 12)
- Re: MSblast worm KF (Aug 12)
- <Possible follow-ups>
- Re: MSblast worm Mike . Keighley (Aug 12)
- Re: MSblast worm tom (Aug 12)
- RE: RE: MSblast worm Jasper Blackwell (Aug 12)
- Re: MSblast worm Johan Denoyer (Aug 12)