A remote overflow exists in the FTP service included with the Sasser worm. This service fails to validate the length of the PORT command prior to using it a string operation, resulting in a stack overflow. With a specially crafted request, an attacker can cause the service to execute arbitrary code, resulting in a loss of confidentiality and integrity.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Solution:
Workaround
Exploit:
Exploit Public
Disclosure:
OSVDB Verified
Solution
Currently, there are no known upgrades or patches to correct this issue. The vendor will not be releasing an updated worm, due to possible incarceration and computer use restrictions. It is possible to correct the flaw by implementing the following workaround(s):
1. Use an anti-virus utility to remove the Sasser worm infection
2. Install the latest patches available for your operating system
We currently have no CVSS2 data on this vulnerability. Feel free to suggest it.
Blogs
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
