Neowin.net

Unchecked Buffer in SNMP Service Could Enable Arbitrary Code to be Run
Originally posted: February 12, 2002 Updated: March 5, 2002

Summary
Who should read this bulletin: System administrators who use Simple Network Management Protocol to manage Microsoft® Windows® 95, 98, 98SE, Windows NT® 4.0, Windows 2000 or Windows XP systems. Impact of vulnerability: Denial of Service, potentially run code of attacker’s choice.

Maximum Severity Rating: Moderate

Recommendation: Customers using SNMP on Windows 2000 and Windows XP should apply the patch. All other customers should disable SNMP service if running; apply patch when available

Affected Software:

Microsoft Windows 95
Microsoft Windows 98
Microsoft Windows 98SE
Microsoft Windows NT 4.0
Microsoft Windows NT 4.0 Server, Terminal Server Edition
Microsoft Windows 2000
Microsoft Windows XP

Vulnerability identifier: CAN-2002-0053

Tested Versions:
Microsoft tested Windows 95, Windows 98, Windows 98SE, Windows ME, Windows NT 4.0, Windows 2000, and Windows XP to assess whether they are affected by this vulnerability. Previous versions are no longer supported, and may or may not be affected by these vulnerabilities.

Patch availability
Download locations for this patch
Windows NT 4.0:
http://www.microsoft.com/downloads/release.asp?ReleaseID=36167
Windows 2000:
http://www.microsoft.com/downloads/release.asp?ReleaseID=36142
Windows XP:
http://www.microsoft.com/downloads/release.asp?ReleaseID=36262

Patches for other platforms are under development and will be available shortly. When this happens, we will re-release this bulletin with information on how to obtain and install these patches.

News source: Microsoft Security Email

The message then goes on to describe the vulnerabilities the worm purports to correct.

The worm, written in Visual Basic, uses Microsoft Outlook and its own SMTP engine to spread. When Q216309.exe it creates two copies of itself, drops the component which uses Outlook and SMTP to spread, creates a Backdoor Trojan that opens port 12378, creates a data file that it uses to store all e-mail addresses it finds, and creates another component that searches for e-mail addresses from the Outlook Address Book and all addresses found in .htm, .html, .asp, and .php files. Once the final component has those e-mail addresses, it writes them to the data file.

Finnish security firm F-Secure Corp. said Wednesday that victims can get rid of the worm by deleting all its components from an infected system. It noted that if some components are locked while Windows is active, they have to be deleted from pure DOS or renamed with a different extension with immediate system restart.

Many anti-virus firms have already updated their virus definitions to detect the worm.