Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: new internet explorer exploit (was new worm)
From: "- -" <erwinp21 () hotmail com>
Date: Tue, 30 Mar 2004 14:16:37 +0000

Drew Coply wrote:
Yeah. It is a zero day worm, and it is very notable as such.

I can not recall a previous zero day worm. (AV is not my job, but I do
try and follow zero day.)

Hence, IE has birthed us the first zero day worm.

On one hand this worm exploits unpatched vulnerabilities, but on the other hand these vulnerabilities were already known for some time, as shown in the references below.


MS attempted to patch one of them, but as we all know they failed doing it properly. Still I think this "worm" is nothing to get to exciting about, it is nothing more than two known vulnerabilites combined. While I think MS should patch those vulnerabilities a.s.a.p, the word 0-day is a bit to strong for this "worm".

Thor Larholm wrote:
K-OTiK posted about this in http://www.securityfocus.com/archive/1/354447 and we posted details of the Ibiza CHM exploit a few weeks before then on the Unpatched mailing list ( http://unpatched.pivxlabs.com ).
I assume you mean the brief analyses you posted earlier to the unpatched mailing list? (sorry, no reference since the unpatched mail archive is currently down) Have you discovered any new noteworthy information about the Bizex worm, since you were still researching the impact of the worm when you send that earlier message to the list?



Free up your inbox with MSN Hotmail Extra Storage. Multiple plans available. http://join.msn.com/?pgmarket=en-us&page=hotmail/es2&ST=1/go/onm00200362ave/direct/01/

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]