Witty Worm targets BlackICE PC Protection systems
| witty-worm-propagation (15543) |  High Risk |
Description:
Witty Worm is a worm that exploits a previously disclosed stack-based buffer overflow in the ICQ response parsing in the Protocol Analysis Module (PAM) of ISS products. Unpatched versions of the BlackICE PC Protection product are affected. The Witty worm does not contain a file payload. Witty worm propagates by sending UDP packets with a random destination and destination port. After transmitting 20,000 packets, the worm writes junk data to the physical hard drive, which results in data corruption. System stability may be affected and could cause a "blue screen" to occur upon reboot.
Refer to Internet Security Systems Security Alert, March 20, 2004 for more information. See References.
Consequences:
Gain Access
Remedy:
Apply ISS Product updates that address this vulnerability, available from the ISS Download Center Web page. See References.
ISS X-Force recommends that networks block UDP packets with a source port of 4000 at the network gateway to block inbound worm propagation.
Data on infected systems may be damaged. ISS X-Force recommends that systems that are infected are removed from the network, but not rebooted. ISS X-Force further recommends that data recovery techniques are employed to assess damage and to recover data.
References:
- Internet Security systems Security Alert, March 20, 2004: BlackICE Witty Worm Propagation.
- ISS Download Center Web page: ISS Download Center.
Platforms Affected:
- IBM ISS BlackICE PC Protection 3.6 ccf
- IBM ISS BlackICE PC Protection 3.6 ccd
- IBM ISS BlackICE PC Protection 3.6cbz cbz
- IBM ISS BlackICE PC Protection 3.6ccb ccb
- IBM ISS BlackICE Server Protection 3.6 ccd
- IBM ISS BlackICE Server Protection 3.6 ccb
- IBM ISS BlackICE Server Protection 3.6 cbz
- IBM ISS BlackICE Server Protection 3.6 ccf
- IBM ISS RealSecure Desktop 3.6 ecd
- IBM ISS RealSecure Desktop 3.6 ece
- IBM ISS RealSecure Desktop 3.6 ecb
- IBM ISS RealSecure Desktop 3.6 ecf
- IBM ISS RealSecure Desktop 3.6 ebz
- IBM ISS RealSecure Desktop 7.0 ebf
- IBM ISS RealSecure Desktop 7.0 ebj
- IBM ISS RealSecure Desktop 7.0 ebk
- IBM ISS RealSecure Desktop 7.0 ebl
- IBM ISS RealSecure Network 7.0 XPU 22.4
- IBM ISS RealSecure Network 7.0 XPU 22.10
- IBM ISS RealSecure Server Sensor 7.0 XPU 22.4
- IBM ISS RealSecure Server Sensor 7.0 XPU 22.10
- ISS BlackICE Agent for Server 3.6 ebz
- ISS BlackICE Agent for Server 3.6 ecb
- ISS BlackICE Agent for Server 3.6 ecf
- ISS BlackICE Agent for Server 3.6 ecd
- ISS BlackICE Agent for Server 3.6 ece
- ISS RealSecure Guard 3.6 ebz
- ISS RealSecure Guard 3.6 ecd
- ISS RealSecure Guard 3.6 ece
- ISS RealSecure Guard 3.6 ecf
- ISS RealSecure Guard 3.6 ecb
- ISS RealSecure Sentry 3.6 ebz
- ISS RealSecure Sentry 3.6 ecb
- ISS RealSecure Sentry 3.6 ecd
- ISS RealSecure Sentry 3.6 ece
- ISS RealSecure Sentry 3.6 ecf
Reported:
Mar 20, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net