On Friday 23 April 2004 9:15 am, Willem Koenings wrote: > > Heya folks. Can I claim possible new Blaster type execution on > > Windows XP SP2 (Buid v. 2096)? Nothing reported by major vendors, > > but ... > > I don't think so. Beside MS04-007 ASN.1 Remote DoS Exploit, there is > worm called Sepuc. It uses multistage infection method via IE/chm > and injects two dll files to lsass process space thus causing lsass > to crash.
Sepuc actually injects four dlls into lsass in two stages, but I don't see lsass crashing because of this. However, the THCIISSLame exploit can crash the lsasrv module in lsass. Normally this just leads to a system error message saying LsaSrv will be disabled, but I'd suspect a total lsass.exe crash (and resulting system shutdown) could be caused on some platforms. We're already seeing this exploit widely used even though there is only one target offset - meaning some successful exploits, but mostly LsaSrv crashes will result. -Joe -- Joe Stewart, GCIH Senior Security Researcher LURHQ http://www.lurhq.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html