Vulnerability

Today Microsoft has released four critical security updates, their KB numbers are: 835732, 828741, 837009, 837001.

This is the 6th security advisory of FreeBSD for the year 2004. The problem is with FreeBSD’s IPv6 implementation, which in turn does not affect our systems at all, because all servers I maintain has disabled IPv6 completely, since there’s no IPv6 devices available at Beijing University of Technology’s public network.

I’ve decided to disclose here (to a small group of people) due to the unresponsiveness from the phpBB group, which is the authoritive vendor of phpBB. A official public full disclose of this vulnerablity will be posted to BugTraq someday later.

Gibe and its variants are still dominant, and MyDoom is approaching to catch up:

beastie# cat drwebd.log | grep infect | grep MyDoom | wc -l
243
beastie# cat drwebd.log | grep infect | grep Gibe | wc -l
257
beastie# cat drwebd.log | grep infect | grep -v Gibe | grep -v MyDoom | wc -l
0

It’s interesting that there’s no viruses without a name “Gibe” nor “MyDoom”…

Thanks junsu and I have got a copy of MyDoom now.

Its MD5 is: 39A7D2BB 5652C9D1 05C0D64A 640C5A9D [UPX unpacked]

Unfortunatelly he said it’s not valuable to research it because a previous analyze done by his colleague indicates that this is not a “skilled” worm.

I’ll keep this for some time. For security reasons I have denied my own execute privilege of that file.

From my Dr.Web log, it seems mydoom is getting its peak. Today it replaced the Win32.HLLM.Gibe.2, to be the king of virus on my mail server :)

It’s to my interest that the virus seemed to be < 32K. So if you have a sample, please send it to me (REMEMBER: Please encrypt it by adding a password in your ZIP or RAR archive, so I will be able to receive it without having the DrWeb to block it.)

Today someone posted a patch to qmail 1.0.3 and pointed out this.

I have a quick patch to this issue, hope it’s correct.