CERT^® Summary CS-99-02

The CERT Coordination Center periodically issues the CERT summary to draw attention to the types of attacks currently being reported to our incident response team, as well as to other noteworthy incident and vulnerability information. The summary includes pointers to sources of information for dealing with the problems.

Past CERT summaries are available from

http://www.cert.org/summaries/

Recent Activity

Since the last CERT summary, issued in February 1999 (CS-99.01), we have seen an increase in virus activity and an increase in the use of some older, known attacks.

Protect your systems. Use current software versions, install patches as they become available, and update your scanning tools and anti-virus software with the latest virus signatures or definitions. Be leery of unsolicited documents or executable programs received in electronic mail. Be wary of software that comes from untrusted sources.

Virus Activity

In the last three months, we have received many reports of virus activity. Current versions of anti-virus software can help to protect your systems from these viruses.

It is important to take great caution with any email or Usenet attachments that contain executable content. If attachments are in a message, we recommend that you save the file to the local drive and scan the file with an anti-virus scanning product before you open or run the file. Be aware that this is not a guarantee that the contents of the file are safe, but it will check for viruses and Trojan horses that your scanning software can detect.

Melissa

The Melissa virus spreads mainly as Microsoft Word 97 and Word 2000 attachments in email. It can be detected and removed by current versions of anti-virus software. For more information see

CERT Advisory CA-99-04 Melissa Macro Virus
http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html

Frequently Asked Questions About the Melissa Virus
http://www.cert.org/tech_tips/Melissa_FAQ.html

CIH/Chernobyl

The CIH virus infects executable files and is spread by executing an infected file. Since many files are executed during normal use of a computer, the CIH virus can infect many files quickly. The most common version of the virus becomes active on April 26, but there are other versions that become active on the 26th day of other months (especially June 26). For more information, see

Incident Note IN-99-03 CIH/Chernobyl Virus
http://www.cert.org/incident_notes/IN-99-03.html

Frequently Asked Questions About the CIH Virus
http://www.cert.org/tech_tips/CIH_FAQ.html

Happy99

Happy99.exe is a Trojan horse virus. The first time Happy99.exe is executed, a fireworks display saying "Happy 99" appears on the computer screen. At the same time, it modifies system files to email itself to other people. For more information, see

IN-99-02 Happy99.exe Trojan Horse
http://www.cert.org/incident_notes/IN-99-02.html

CA-99-02 Trojan Horses
http://www.cert.org/advisories/CA-99-02-Trojan-Horses.html

Resurgence of SYN Attacks

Recently we have received an increased number of reports of SYN attacks that result in a denial of service. This is a known exploitation method for which protection is available. For information about how SYN attacks work and how to protect your systems, see

CERT Advisory CA-96.21 TCP SYN Flooding and IP Spoofing Attacks
http://www.cert.org/advisories/CA-96.21.tcp_syn_flooding.html

For more information about denial of service attacks, see
Denial of Service
http://www.cert.org/tech_tips/denial_of_service.html

Continued Widespread Scans

We are still receiving daily reports of intruders using tools to scan networks for multiple vulnerabilities. Intruder scanning tools continue to become more sophisticated, varying from scripted tools and stealth scanning techniques to a tool that incorporates probes for known vulnerabilities, remote operating system identification, and a scripting language that simplifies automation of probes and exploitation attempts. For more information, see

"sscan" Scanning Tool
http://www.cert.org/incident_notes/IN-99-01.html

Automated Scanning and Exploitation
http://www.cert.org/incident_notes/IN-98-06.html

Probes with Spoofed IP Addresses
http://www.cert.org/incident_notes/IN-98-05.html

Advanced Scanning
http://www.cert.org/incident_notes/IN-98.04.html

New Tools Used for Widespread Scans
http://www.cert.org/incident_notes/IN-98.02.html

The most frequent reports involve well-known vulnerabilities in mountd, IMAP, and POP3. These services are installed and enabled by default in some operating systems. See the following advisories for more information:
sunrpc (TCP port 111) and mountd (635)
http://www.cert.org/advisories/CA-98.12.mountd.html

IMAP (TCP port 143)
http://www.cert.org/advisories/CA-98.09.imapd.html

POP3 (TCP port 110)
http://www.cert.org/advisories/CA-98.08.qpopper_vul.html

While these scans involve known vulnerabilites for which patches are available, the scans and exploitation attempts still result in sites being compromised because system security has not been kept up-to-date. Protect your systems. Make sure that all systems at your site have current versions of patches and that your machines are properly secured.

Web Server Attacks

We have been receiving reports of attacks exploiting vulnerabilities in sample applications in Cold Fusion and IIS. The attacks result in read and write access on the web server, allowing intruders to change web pages at will. For information, see

Allaire Security Bulletin ASB99-02 ColdFusion 4.0 Example Applications and Sample Code Exposes Servers
http://www.allaire.com/security/


Microsoft Internet Information Server 4.0 Security Checklist
http://www.microsoft.com/security/products/iis/checklist.asp

What's New and Updated

• Advisories
• Incident notes
• Security improvement modules
• Technical reports
• Information about computer security education

http://www.cert.org/nav/whatsnew.html

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

Getting security information

http://www.cert.org/

subscribe cert-advisory

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

Copyright 1999 Carnegie Mellon University.