Infocon To "yellow Alert"...ms04-11 Vuln Worm!

FYI…from the Internet Storm Center:

Infocon status raised to "Yellow Alert"…MS04-11 vuln Worm!
- http://isc.sans.org/diary.php?date=2004-05-01
Updated May 1st 2004 17:18 UTC
Sasser Worm Update
Symantec has released their analysis of the Sasser worm and have it classified currently as a Level 2. Their analysis can be found at:
- http://securityresponse.symantec.com/avcen…asser.worm.html
"W32.Sasser.Worm is a worm that attempts to exploit the MS04-011 vulnerability. It spreads by scanning randomly-chosen IP addresses for vulnerable systems…"

The Secunia site provides links to the major vendors and their analysis. They are also listing this as a medium threat right now:
- http://secunia.com/virus_information/9142/sasser/ …"

FYI…

Sasser Worm Removal Tool

- http://www.sarc.com/avcenter/venc/data/w32…moval.tool.html
Updated on: May 1, 2004 02:46:34 PM PDT

.

FYI…

- http://isc.sans.org/diary.php?date=2004-05-02
Updated May 2nd 2004 21:54 UTC
"Multiple Exploits targeting Microsoft MS-04-011 vulnerabilities threaten networks
Sasser/SasserB and SasserC are just one component of multiple MS04-011 Exploits Threatening Networks
SasserC, reported by Joe Stewart of Security Service Provider LURHQ ( http://www.lurhq.com ), is currently undergoing analysis. Joe reports that SasserC spawns 1024 threads to attack other systems, and it seems poised to torch networks that are not patched for the MS04-011 vulnerabilities. Let's hope MS shares some realtime numbers of infected systems from their customers use of the Microsoft Sasser cleaning tool (link below). In addition, Gaobot variants are actively exploiting systems using MS04-011 vulnerabilities too…

Microsoft's Sasser Removal Tool
- http://www.microsoft.com/downloads/details…&displaylang=en
"Step 4: Review Additional Technical Resources - If the cleaning tool above doesn't work for you, use the free worm removal tool available at your preferred antivirus software vendor's Web site"…" –> (Long list of vendors supplied here: http://isc.sans.org/diary.php?date=2004-05-02 )

Also:
- http://www.sarc.com/avcenter/venc/data/w32…ser.b.worm.html
Last Updated on: May 02, 2004 01:00:55 PM
"…Security Response is upgrading W32.Sasser.B.Worm to a Category 4 from a Category 3 based on increased rate of submissions…"

FYI…

Back to Green
- http://isc.sans.org/diary.php?date=2004-05-04
"Yes…we are back to green. Things are quite calm, there is no new version of Sasser and no significant impact is being observed.
Some numbers about Sasser:
According to Microsoft, 1.5 million users downloaded the cleanup tool via Windows Update.
The Internet Storm Center numbers are close to Microsoft:
- 500k on May 1st
- 700k on May 2nd …"