-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 INTERNET RISK UPDATE for 06-20-2002 ISS X-Force Internet Threat Intelligence Center www.iss.net - Click on the AlertCon logo for more information. ******************************************** ALERTCON 3 Projected: AlertCon 3 ******************************************** ALERTCON 3 - We are at AlertCon 3. VULNERABILITIES: ISS X-Force has discovered a serious vulnerability in the default version of Apache HTTP Server. Apache is the most popular Web server and is used on over half of all Web servers on the Internet. X-Force has verified that this issue is exploitable on Apache HTTP Server version 1.3.24 for Windows (Win32) as well as Apache HTTP Server version 1.3.24 for Open BSD. It has been reported that exploit code has been developed for the following operating systems and platforms: Sun Solaris 6-8 (Sparc/x86) FreeBSD 4.3-4.5 (x86) OpenBSD 2.6-3.1 (x86) Linux (GNU) 2.4 (x86) VIRUSES/WORMS: IRC_NOWE.A - This IRC script malware is a component of the batch file worm, BAT_NOWE.A. It replaces the mIRC configuration file, SCRIPT.INI, to facilitate the worm's propagation using the Internet Relay Chat client. ******************************************** RECOMMENDATIONS ******************************************** The X-Force has released an advisory with patching instructions for the default setting of the Apache HTTP Server. This advisory requires immediate action on behalf of all system users with Apache HTTP Server. http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=2052 4 For a list of current vulnerabilities, please see: https://gtoc.iss.net/vulnerabilities.php For information on the current Virus/Worm of the day, please refer to: Information regarding other viruses and worms please see: https://gtoc.iss.net/viruses.php ******************************************** FACTOID: Three federal agencies have formed an alliance to help small businesses protect their information technology. The National Infrastructure Protection Center, a part of the Federal Bureau of Investigation, the U.S. Small Business Administration, and the Commerce Department's National Institute of Standards and Technology will provide computer and IT security to the companies. The agencies will sponsor a series of workshops in Washington, San Francisco and Chicago to help train small-business owners to identify cost-effective security products, processes and services, according to ZDNet News. ******************************************** ATTACK SIGNATURE RANKING - global IDS, midnight - midnight, previous Day, % of total ******************************************** Suspicious Activity 32.45% Unauthorized Access Attempt 24.15% Protocol Decode 20.99% Pre-Attack Probe 07.21% Denial Of Service 15.17% Back Door 07.21% ******************************************** TOP ATTACK DESTINATION PORTS - global IDS, midnight - midnight, previous day, % of top ports (ports found at) http://www.neohapsis.com/neolabs/neo-ports/neo-ports.html ******************************************** 80 (http) 72.83% 25 (smtp) 06.92% 23 (telnet) 06.70% 139 (NetBIOS) 03.25% 69 (tftp) 02.53% 161 (SNMP) 02.40% 1433 (SQL) 01.93% 21 (ftp) 01.79% 22 (ssh) 00.97% 162 (SNMPTrap) 00.68% ******************************************** BACKGROUND, COPYRIGHT NOTICE, and DISCLAIMER ******************************************** Background. We provide this information in the spirit of PDD 63 to help security professionals wage the war against Internet threats more effectively. Information in this update derived primarily from global, real time, 24 x 7 IDS feeds, ISS X-Force R&D Team research, and professional liaison. Other sources as noted. AlertCon 1 reflects the global, malicious, determined, 24 x 7 attacks experienced by all networks. AlertCon 2 means increased vigilance/action recommended due to a specific threat or concern. AlertCon 3 means increased attacks against specific targets or vulnerabilities on a scale that is unusually high, action required. AlertCon 4 reflects an Internet emergency for a target or group of targets whose business continuity may depend on some sort of immediate, decisive action. All summaries cover 24 hours the previous workday, GMT. Monday summaries may cover some weekend activity. Copyright 2002 Internet Security Systems, Inc. Permission is granted for the redistribution of the Internet Risk electronically. It is not to be sold or edited in any way without express consent of ISS. Refer comments or questions to: [EMAIL PROTECTED] or [EMAIL PROTECTED] Disclaimer: This information is subject to change without notice. Use of this information constitutes acceptance for use in an 'as is' condition. There are no warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. No other use authorized. FOIA Exemption 4. Carter Schoenberg Senior Analyst Internet Threat Intelligence Center 6303 Barfield Road Atlanta, Georgia 30306 United States Third rock from the sun (404) 236-4045 work (404) 281-8296 cell -----BEGIN PGP SIGNATURE----- Version: PGP 7.0 iQA/AwUBPRHlOgtw29BQsC/uEQIsDACggtsh0UAU+ExLF91UqLsViL1Am0AAnRYq 75mvamHBKRv0lFT/IaAT7+T3 =0USG -----END PGP SIGNATURE-----
PGPexch.htm.asc
Description: Binary data
