[Full-Disclosure] New Worm Discovery - Potential Korgo Variant
mikeyoung at milestechnologies.com
Thu Jun 24 15:14:19 BST 2004
The worm clearly exploits the LSASS overflow and is not spreading through
the FTP dameon left by Sasser.
From: Cedric Blancher [mailto:blancher at cartel-securite.fr]
Sent: Thursday, June 24, 2004 10:04 AM
To: Michael Young
Cc: full-disclosure at lists.netsys.com
Subject: Re: [Full-Disclosure] New Worm Discovery - Potential Korgo Variant
Le jeu 24/06/2004 à 14:57, Michael Young a écrit :
> Yesterday a large client of ours was taken down by what appears to be
> a Korgo variant, but I have been unable to locate any information on
> this worm. From what we have discovered, the main process is
> VDisp.exe. It is spreading through unpatched systems vulnerable to
> the LSASS exploit, and propagates itself through a serious of randomly
> chosen ports.
Korgo exploits a buffer overflow within FTP daemon installed by Sasser.
That would mean your client systems were previously infected by
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!
Full-Disclosure is hosted and sponsored by Secunia.