Re: re: First Report : New Blaster?

[Joe Stewart <jstewart () lurhq com>]

On Friday 23 April 2004 9:15 am, Willem Koenings wrote:
> > Heya folks. Can I claim possible new Blaster type execution on
> > Windows XP SP2 (Buid v. 2096)? Nothing reported by major vendors,
> > but ...
>
> I don't think so. Beside MS04-007 ASN.1 Remote DoS Exploit, there is
> worm called Sepuc. It uses multistage infection method via IE/chm
> and injects two dll files to lsass process space thus causing lsass
> to crash.

Sepuc actually injects four dlls into lsass in two stages, but I don't 
see lsass crashing because of this. However, the THCIISSLame exploit 
can crash the lsasrv module in lsass. Normally this just leads to a 
system error message saying LsaSrv will be disabled, but I'd suspect a 
total lsass.exe crash (and resulting system shutdown) could be caused 
on some platforms. We're already seeing this exploit widely used even 
though there is only one target offset - meaning some successful 
exploits, but mostly LsaSrv crashes will result.

-Joe

-- 
Joe Stewart, GCIH 
Senior Security Researcher
LURHQ http://www.lurhq.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html