Last Updated: 2005-11-01 23:04:43 UTC
by Bojan Zdrnja (Version: 2)
We have received numerous reports of new Bagle variants being spammed. They look typical for this family of worms ? empty message body with a ZIP file in the attachment.
Some of them don't have any subject and the sender name will be same as the recipient name with (sometimes) random domain appended.
Some names that have been used are:
MD5 sums of some variants are:
In the archive there is an executable which, when executed, copies itself to %sysdir%\hloader_exe.exe and drops another DLL header_dll.dll. It also creates an entry in the registry key HKLM/Software/Microsoft/Windows/CurrentVersion/Run named auto__hloader__key.
Thanks to Mike S, Sean K and others for submitting samples and information about these worms.
Mark Tombaugh sent us Snort sigs which can help protect from these new Bagle variants:
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"BLEEDING-EDGE VIRUS Bagle.dk SMTP Inbound"; flow:to_server,established; content:"UEsDBBQA"; content:"YT"; distance:8; within:11; content:"AAAA"; distance:8; within:13; reference:url,vil.nai.com/vil/content/v_136751.htm; sid:2002665; rev:1;)
alert tcp $HOME_NET 25 -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE VIRUS Bagle.dk SMTP Outbound"; flow:to_server,established; content:"UEsDBBQA"; content:"YT"; distance:8; within:11; content:"AAAA"; distance:8; within:13; reference:url,vil.nai.com/vil/content/v_136751.htm; sid:2002666; rev:1;)
Last Updated: 2005-11-01 17:25:01 UTC
by Joshua Wright (Version: 1)
The worm uses the UTL_TCP package to scan for remote Oracle databases on the same local network. Upon finding another database, the SID is retrieved and the worm uses several default username and password combinations to attempt to login to the remote database. Currently, the default/username password list includes:
In its current state, the worm isn't a terribly significant threat. However, is can be treated as an early warning sign for future variants of the worm that include additional propagation methods. Oracle DBA's can take several actions to mitigate the effect of this worm and possible future variants:
- Change the Oracle listener from the default port of TCP/1521 (and set a listener password while you are at it)
- Drop or lock default user accounts if possible. Ensure all default accounts do not use default passwords.
- Revoke PUBLIC privileges to the UTL_TCP, UTL_INADDR packages.
- Revoke CREATE DATABASE LINK privileges granted to users who do not need to link to remote databases, including the CONNECT role.
If you are concerned or interested about Oracle security issues, a wonderful resource for keeping current is Pete Finnigan's blog at www.petefinnigan.com/weblog/. I make it a point to check Pete's blog every day and I'm never disappointed.
Last Updated: 2005-11-01 01:54:53 UTC
by Jason Lam (Version: 2)
OS X 10.4.3 can be downloaded from http://www.apple.com/support/downloads/