Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have recently gotten a prompt from my anti virus stating that there was an intrusion with an OS attack as describe in the link below:

http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=20443

It seems that it isn't the first time occurring and it happens sometimes when I use my mobile 3G stick to connect myself to the Internet.

I am quite worried if there were to be any compromise and I do not really understand what the page in the link was saying.

Could someone help me out and let me know what should I do?

Note: I am running windows 7 32bit.

share|improve this question
    
Did you not bother to read the whole thing? There are patches at the bottom of the page to implement. –  Hae0 Jul 24 at 4:16
    
Thanks for your reply. Yes I did. I am running windows 7 32bit. Doesn't seem to have a patch for that in the affected list –  toffee.beanns Jul 24 at 4:43
    
I believe you are okay, if your version was actually susceptible then I'm quite sure a patch would be implemented. Just monitor your system, run daily scans with various tools etc. –  Hae0 Jul 24 at 5:44
    
May I ask if it's safe to continue using the computer since "It has been observed that W32.Gaobot and W32.RXBot worms are exploiting this issue to propagate." stated in the website listed in the question would affect the network spreading the vulnerability? –  toffee.beanns Jul 24 at 9:16

2 Answers 2

The page lists the affected systems and your windows 7 32bit is not included:

Affected
Avaya DefinityOne Media Servers
Avaya IP600 Media Servers
Avaya S3400 Message Application Server
Avaya S8100 Media Servers
Microsoft Windows 2000 Advanced Server SP1, SP2, SP3, SP4
Microsoft Windows 2000 Datacenter Server SP1, SP2, SP3, SP4
Microsoft Windows 2000 Professional SP1, SP2, SP3, SP4
Microsoft Windows 2000 Server SP1, SP2, SP3, SP4
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Datacenter Edition Itanium
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Enterprise Edition Itanium
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP 64-bit Edition SP1
Microsoft Windows XP 64-bit Edition Version 2003 SP1
Microsoft Windows XP Home SP1
Microsoft Windows XP Professional SP1

Your "protection software" is showing you that someone is trying to attack you but since your system is not vulnerable but this attack you can simple ignore it.

In my opinion the software is crap. It should not bother you with this.

share|improve this answer
    
It's possible a similar attack involving an over-sized request exists on Windows 7 32-bit. It seems to be a software issue, so toffee.beanns may have installed Microsoft Windows LSA DS on the OS, however there may be a similar service on Windows 7 32-bit, installed or from factory, that would be vulnerable to something similar enough to trigger the alarm. –  JVE999 Jul 24 at 8:39
    
@JVE999 Sure that is possible but the affected software is kind of old. CVS is from 2003. So I belive the bug is fixed the newer versions. –  PiTheNumber Jul 24 at 8:59
    
@PiTheNumber Thanks. May I just clarify about the software that you were referring to as crappy is the anti virus? –  toffee.beanns Jul 24 at 9:13
    
@toffee.beanns Yes. I think it should not warn you if it's not a thread. There is also a endless discussion about how useful anti virus software is but I don't want to get into this ;) –  PiTheNumber Jul 24 at 9:17
1  
@PiTheNumber well if it's warnings that pop up in your face I couldn't agree more. Generally you want to make the information relevant to the user's security visible but security remains a secondary task so you should be able to use your system transparently regardless of security indicators. www.ics.uci.edu/~jie/soups05.pdf calls it transparent security and I agree with him that's what we should aim for. –  Steve DL Jul 25 at 8:49

As said on the link you point to, this vulnerability concerns only pre-2003 versions of Microsoft LSASS. It also says that some worms are known to try and exploit this vulnerability to propagate. Essentially, they just try and send a request to your OS's Local Security Authority Directory Service (whatever that is, it's probably built-in many Windows versions because used to build corporate networks). If the worm is lucky, you will be running a LSA DS, and if even more lucky it will be old enough for the exploit to work and for the worm to gain control of that service and do whatever wormy things it needs to do.

So, you're not very concerned so far. Your OS is recent enough for this vulnerability to have been fixed and no worms or viruses can exploit it.

But this is not the end of the story. You stated that this happened when you plugged in your mobile 3G stick. Hence it's very likely that your 3G stick executes some code when plugged (either via an exploit in a Windows driver, or because you installed some software that allows it to, or because that very component is expected by Windows to run some code when plugged; I'm not a Windows user so I have no idea), and that this code contains at least one exploit. It is quite likely that it also contains other exploits, to increase the chances of taking over your machine. Maybe some of these other exploits work on Windows 7.

You should first assess the reputation of the 3G key provider and manufacturer. Have they been caught serving malware to their clients before? Or are they themselves potentially victims of an employee or outsider? Do you trust them? It's up to you to decide that but I would contact them and ask why their 3G key seems to be containing malware. If I were you, I would run a full scan of my system with whatever antivirus utility I can put my hands on. It's not impossible that you're infected by some other exploit.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.