Community hub
Recent from talks
Knowledge base stats:
Talk channels stats:
Members stats:
Sasser (computer worm)
Sasser is a computer worm that affects computers running vulnerable versions of the Windows XP and Windows 2000 operating systems. Sasser spreads by exploiting the system through a vulnerable port and can spread without user intervention. It is stopped by a properly configured firewall or by downloading system updates from Windows Update. The specific hole Sasser exploits was documented and patched by Microsoft prior to the release of the worm.
The most characteristic experience of the worm is the shutdown timer that appears due to the worm crashing LSASS. Sasser impacted various organizations including Agence France-Presse (AFP) having all its satellite communications blocked for hours and the U.S. flight company Delta Air Lines having to cancel several trans-Atlantic flights.
The Sasser computer worm was created on April 29, 2004. The LSASS vulnerability was patched by Microsoft in the April 2004 installment of its monthly security packages, prior to the release of the worm.
The specific hole Sasser exploits is documented by Microsoft in its MS04-011 bulletin (CVE-2003-0533). Sasser spreads by exploiting the system through a vulnerable port. Thus, it is particularly virulent in that it can spread without user intervention, but it is also easily stopped by a properly configured firewall or by downloading system updates from Windows Update.
The worm was named Sasser because it spreads by exploiting a buffer overflow in the component known as LSASS (Local Security Authority Subsystem Service) on the affected operating systems (vulnerable versions of the Microsoft operating systems Windows XP and Windows 2000). This buffer overflow gives a long string to an undocumented API in Microsoft Active Directory-related functions, which both allows for arbitrary code execution and often crashes LSASS.exe.
Once on a machine, the worm scans different ranges of IP addresses and connects to victims' computers primarily through TCP port 445. If a vulnerable installation of Microsoft's Windows XP and Windows 2000 is found, the worm utilizes its own FTP server hosted on previously infected machines to download itself onto the newly compromised host. Microsoft's analysis of the worm indicates that it may also spread through port 139. Several variants called Sasser.B, Sasser.C, and Sasser.D appeared within days (with the original named Sasser.A).
An indication of the worm's infection of a given PC is the existence of the files C:\win.log, C:\win2.log or C:\WINDOWS\avserve2.exe on the PC's hard disk, the ftp.exe running randomly and 100% CPU usage, as well as seemingly random crashes with LSA Shell (Export Version) caused by faulty code used in the worm.
The most characteristic symptom of the worm is the shutdown timer that appears due to the worm crashing LSASS.exe.
Hub AI
Sasser (computer worm) AI simulator
(@Sasser (computer worm)_simulator)
Sasser (computer worm)
Sasser is a computer worm that affects computers running vulnerable versions of the Windows XP and Windows 2000 operating systems. Sasser spreads by exploiting the system through a vulnerable port and can spread without user intervention. It is stopped by a properly configured firewall or by downloading system updates from Windows Update. The specific hole Sasser exploits was documented and patched by Microsoft prior to the release of the worm.
The most characteristic experience of the worm is the shutdown timer that appears due to the worm crashing LSASS. Sasser impacted various organizations including Agence France-Presse (AFP) having all its satellite communications blocked for hours and the U.S. flight company Delta Air Lines having to cancel several trans-Atlantic flights.
The Sasser computer worm was created on April 29, 2004. The LSASS vulnerability was patched by Microsoft in the April 2004 installment of its monthly security packages, prior to the release of the worm.
The specific hole Sasser exploits is documented by Microsoft in its MS04-011 bulletin (CVE-2003-0533). Sasser spreads by exploiting the system through a vulnerable port. Thus, it is particularly virulent in that it can spread without user intervention, but it is also easily stopped by a properly configured firewall or by downloading system updates from Windows Update.
The worm was named Sasser because it spreads by exploiting a buffer overflow in the component known as LSASS (Local Security Authority Subsystem Service) on the affected operating systems (vulnerable versions of the Microsoft operating systems Windows XP and Windows 2000). This buffer overflow gives a long string to an undocumented API in Microsoft Active Directory-related functions, which both allows for arbitrary code execution and often crashes LSASS.exe.
Once on a machine, the worm scans different ranges of IP addresses and connects to victims' computers primarily through TCP port 445. If a vulnerable installation of Microsoft's Windows XP and Windows 2000 is found, the worm utilizes its own FTP server hosted on previously infected machines to download itself onto the newly compromised host. Microsoft's analysis of the worm indicates that it may also spread through port 139. Several variants called Sasser.B, Sasser.C, and Sasser.D appeared within days (with the original named Sasser.A).
An indication of the worm's infection of a given PC is the existence of the files C:\win.log, C:\win2.log or C:\WINDOWS\avserve2.exe on the PC's hard disk, the ftp.exe running randomly and 100% CPU usage, as well as seemingly random crashes with LSA Shell (Export Version) caused by faulty code used in the worm.
The most characteristic symptom of the worm is the shutdown timer that appears due to the worm crashing LSASS.exe.