W32/Mydoom.ag@MM - Zero Day IE I-FRAME Attack

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

BleepingComputer.com > Security > Breaking Virus & Security News

W32/Mydoom.ag@MM - Zero Day IE I-FRAME Attack, Be careful with HTML email

Options

harrywaldron View Member Profile	Nov 8 2004, 04:57 PM Post #1
Security Reporter Group: News Reporters Posts: 491 Joined: 10-April 04 From: Roanoke, Virginia Member No.: 107	This brand new version of MyDoom is HTML based and does not contain attachments. It also exploits a critical IE vulnerability, so AV protection plus best practices are needed -- as this one has some potential. W32/Mydoom.ag@MM - Zero Day IE I-FRAME Attack http://secunia.com/virus_information/13213/mydoom.ag/ http://vil.nai.com/vil/content/v_129630.htm This W32/Mydoom@MM variant makes use of a zero day attack targeting a Microsoft Internet Explorer IFRAME buffer overflow vulnerability. The virus spreads by sending email messages to addresses found on the local system. The message appears as follows: From: Spoofed address Subject: may vary * funny photos * hello * hey! * blank There is no attachment to the message. The homepage hyperlink points to the infected system which sent the email message. Clicking on the link, accesses a web server running on the compromised system. The web server serves HTML that contains IFRAME buffer overflow code to automatically execute the virus. Infected systems will show Internet Explorer listening on TCP Port 1639, the port the web server runs on. Information on the IFRAME vulnerability can be found here: Internet Explorer IFRAME Buffer Overflow Vulnerability http://secunia.com/advisories/12959/ -------------------- Microsoft Security Journal

« Next Oldest · Breaking Virus & Security News · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 5th December 2008 - 01:44 AM

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Malware Removal Guides