 |
|||||
|
|
|
|||
|
|
 |
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|||
|
|
 |
|
|
|
|
|
|
|||
|
|||||
|
|||||
|
|||||
|
|
|
|||
|
|
|
|
||
|
|
|
|||
|
|||||
| Reference: | CERT-IST/AL-2008.002 |
| Version: | 1.0 |
| Version date: | 27 November 2008 |
|
|
Vulnerability Classification
| Risk: |
|
||
| Impact: | Take control | ||
| Confidence: | Vendor-acknowledged | ||
| Attack expertise: | Beginner | ||
| Attack requirements: | Remote (no account) over a standard service | ||
|
|||
System Information
| Affected Platform(s): |
|
| Affected Software(s): |
|
| Impacted products |
Description
| Problem description: |
|
|
We send this alert because we received confirmed reports of infection by the "Conficker" worm within our IST constituency. The "Conficker" worm is described in the CERT-IST/AV-2008.504 advisory. This worm spreads by exploiting the RPC vulnerability of the "Server" service (MS08-067) of Microsoft Windows systems and enables to open a backdoor on infected systems. It seems that some "Conficker" variants are not correctly detected by anti-virus (up to date). We recommend thus to block the URL used by the worm (see solution 02). Systems that have applied the patches mentionned in the MS08-067 bulletin are not impacted. |
|
Solution
01 - Apply the solutions described in the CERT-IST/AV-2008.460 advisory The CERT-IST/AV-2008.460 advisory indicates the available patches to fix the MS08-067 vulnerability in Microsoft Windows. It also gives workarounds as well as tools and signatures available to detect attack attempts. 02 - Block the web sites contacted by "Conficker" It seems that some anti-virus editors do not detect completely the "Conficker" worm (or its variants). A workaround is to filter the following sites on the Internet gateways : [http://]trafficconverter.biz/4vir/antispyware/loada[removed] [http://]www.maxmind.com/download/geoip/database/GeoIP.[removed] "Conficker" also attempts to contact the following sites to obtain the IP address of the infected computer: [http://]www.getmyip.org [http://]/getmyip.co.uk [http://]checkip.dyndns.org The worm also attempts to contact the following sites to obtain the current date: [http://]www.w3.org [http://]www.ask.com [http://]www.msn.com [http://]www.yahoo.com [http://]www.google.com [http://]www.baidu.com |
|
Standard vulnerability IDs
|
|
Additional Resources
|
|
History
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||