I won't get in the whole worm - virus , blah blah blah debate. But with
Blaster heres the wrinkle people seem to miss, although it should be the
most obvious bit!
The MS bug is the real problem, the worm is incidental. An 'infection'
facilitates propagation. Thats all.
Yes, that is what I have tried to point out. The vulnerability itself
is very dangerous to leave unpatched, forget the worm ~ patch
the vulnerability.
...and on the flip side, a patch doesn't make the system immune
to the worm, it only closes the primary way it gains access. Okay,
granted it is the *only* vector coded into the worm itself, but it
is not the only vector used by the distributor.
The system issues, whether the 'shutdown' issue in XP, or the many other
symptoms exhibited by Win2k systems do not require infection at all. If
system hasn't been patched to prevent the exploit, AV software could stop
the executable from being dropped,
I think that local AV must allow the drop, at least temporarily,
but I'm not sure. Anyway, the method used to run the executable
is by the OS's assistance, not by exploitation, so the AV should
be able to intervene at that point. If people think that their AV is
enough to catch this worm, maybe that is so, but what about the
vulnerability itself and other malware that exploits it.
and by doing so prevent the local machine
from spreading the worm but it can't stop the 'exploit' . RPC ! Look it up.
I have. Most of my posts on this subject address just this
thing that you mention.
The code that causes the shutdown issues isn't running locally.
Yes it is, it is running through the local buffer overrun. In some
cases the exploit code doesn't have the desired effect on the
local system and thus causes the problems.
Patching prevents the exploit, but won't prevent the worm from spreading if
the system was already 'infected'.
True, and it won't stop the system from becoming affected
by the worms entrance through some other vector. I don't
know whether or not the worm's executable is OS specific,
but if you ignore the vulnerability's OS specificity to get the
executable onboard, other OS's are still affectable unless
for some reason the worm executable won't work on those
OSes.
There is the "pure worm" aspect of a vulnerability such as
this, which (if the affected buffer were large enough) would
have been a problem in and of itself like the Sapphire worm,
*and* the other less pure worm aspect that might not be as
OS specific as the former. It may be a mistake to treat this
worm as if it doesn't affect some OSes just because it only
normally uses that particular exploit to gain control.
This would have been more obvious if this worm had been
coded as a multiple vector worm.