 W32/Mydoom.AH - MEDIUM risk for IFRAME exploit, please be careful with EMAIL links |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.| Important Announcement: In recognition of reaching a milestone of 1,000,000 posts on the site, we are hosting the BC 1 Million Post contest. More information about this contest can be found at the following link: Bleeping Computer 1,000,000 Post Contest - BleepingComputer Management |
  |
  Nov 9 2004, 06:38 AM
Post
#1
|
|
 Security Reporter  Group: News Reporters Posts: 491 Joined: 10-April 04 From: Roanoke, Virginia Member No.: 107  |
It exploits a critical IE vulnerability when you click on a URL found in the email message. Please always avoid clicking on links in spam or unwanted email messages. There may be more variants coming as this one is easy to copy. W32/Mydoom.AH - MEDIUM risk for IFRAME exploit http://secunia.com/virus_information/13223/mydoom.ah/ http://vil.nai.com/vil/content/v_129631.htm http://www.sarc.com/avcenter/venc/data/w32.mydoom.ah@mm.html http://www.trendmicro.com/vinfo/virusencyc...=WORM_MYDOOM.AH Internet Storm Report http://isc.sans.org//diary.php?date=2004-11-08 This W32/Mydoom@MM variant makes use of a zero day attack targeting a Microsoft Internet Explorer IFRAME buffer overflow vulnerability. The virus spreads by sending email messages to addresses found on the local system. The message appears as follows: From: Spoofed address (may be exchange-robot@paypal.com when sending paypal message body below) Subject: (case may vary) hi! hey! Confirmation blank There is no attachment to the message. The homepage hyperlink points to the infected system which sent the email message. Clicking on the link, accesses a web server running on the compromised system. The web server serves HTML that contains IFRAME buffer overflow code to automatically execute the virus. Infected systems will show Internet Explorer listening on TCP Port 1639, the port the web server runs on. Information on the IFRAME vulnerability can be found here: Internet Explorer IFRAME Buffer Overflow Vulnerability http://secunia.com/advisories/12959/ EXAMPLE of PAYPAL message that's spreading QUOTE Congratulations! PayPal has successfully charged $175 to your credit card. Your order tracking number is A866DEC0, and your item will be shipped within three business days. To see details please click this link DO NOT REPLY TO THIS MESSAGE VIA EMAIL! This email is being sent by an automated message system and the reply will not be received. Thank you for using PayPal AVERT STINGER - can remove this new variant http://vil.nai.com/vil/stinger -------------------- |
 |
 
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 20th November 2008 - 03:18 AM |
© 2003-2008 All Rights Reserved Bleeping Computer LLC.