TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Pedro,
This worm utilizes two different vulnerabilities, and RealSecure can be used
to protect you against both.
The first vulnerability, sadmind buffer overflow, is covered by both an
Internet Scanner check and a Network Sensor signature. The Internet Scanner
check was added in XPU 4.6, and is called SolSadmindAmslverifyBo. The
Network Sensor signature is called Sadmind_Amslverify_Overflow, and was
included in XPU 1.3.
The second vulnerability is iis-unicode-translation. A user-defined
signature for Network Sensor was developed and distributed through an
X-Force Alert. For information on how to implement this signature, please
see the Alert: http://xforce.iss.net/alerts/advise68.php. This signature
will also be included in the next Network Sensor XPU. Internet Scanner also
detects this vulnerability through IisUnicodeTranslation check, included in
XPU 4.4.
Jamie Lau
-----Original Message-----
From: Pedro Fernandez [mailto:[EMAIL PROTECTED]]
Sent: Thursday, May 31, 2001 10:51 AM
To: [EMAIL PROTECTED]
Subject: Worm IIS
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
Hi,
Is the CA-2001-11 sadmind/IIS Worm vulnerability advisory covered by the
last Xpress Update of Real Secure?
or exists other way who detect!
Thanks
Pedro Fern�ndez A.
Consultor en Seguridad - ISS Certified
Orion 2000 S.A.- Servicios Profesionales en Seguridad Inform�tica
La Concepci�n 322 Piso 12 Providencia
Santiago, Chile
Fono : 56-2-6403942, Fax : 56-2-6403990
mailto:[EMAIL PROTECTED]
http://www.orion.cl
