Re: Virus Outbreak Attacking MS05-039
Peter Wan <[email protected]>
| Newsgroups | gmane.comp.security.virus |
|---|---|
| Message-ID | <[email protected]> |
According to the ISC diary archive: Zotob affecting some XP SP2/2003? Reader Samuli writes in (thanks Samuli!) pointing out that the houseofdabus code used in the Zotob worm to exploit the Microsoft PnP vulnerability addresses in MS05-039 relies on NULL sessions to exploit the target system. Default installations of Windows XP SP2 and Windows 2003 do not have NULL sessions enabled, and thus are not affected by the worm. However, some server roles may require administrators to enable NULL session functionality, such as legacy domain controllers, Microsoft Exchange servers, Microsoft SQL Servers, etc. If you have permitted NULL session access on your managed systems, you may be at risk of infection by one of the Zotob variants. On 8/15/05, Eddie Willett <[email protected]> wrote: > I have read that this virus can be spread on any windows os but only > affects 2000, 2003??, xp?? I have gotten conflicting reports about the > last. What is the truth to this. Does anyone know? > > Eddie -- Peter Wan <[email protected]>