Re: [Full-Disclosure] MSblast worm

[Robert Lemos <robert@infoserf.net>]

On Tue, 2003-08-12 at 04:09, Johan Denoyer wrote:
> worms affects :
> 
> Microsoft Windows NT 4.0
> Microsoft Windows 2000
> Microsoft Windows XP
> Microsoft Windows Server 2003
>
> > Does anyone know if this MSblast worm affects Win NT machines, or is it
> > just
> > infecting 2000 and XP.

This is wrong, from everything that I've heard. The worm uses an exploit
that could affect those systems, but in reality it only has two offsets
for executable entry: One for Windows XP and another for Windows 2000. 

It does no OS checking but rather sends the exploit with the XP offset
80 percent of the time and the 2K offset the rest of the time.

So, is NT, 98, 2003 vulnerable? Not unless they have either of those
particular offsets in common with Windows XP and Windows 2K. However,
it's likely that such systems could crash.

-R


-- 
| robert lemos | technology journalist   |
| e: robert@infoserf.net | pgp: 12980B23 |

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html