Partner With Us Compare Prices GPS Home Improvement Calling Cards Promotional Items Web Hosting Directory Memory PDA Phones & Cases Desktop Computers Logo Design Hurricane Shutters Baby Photo Contest Computer Deals KVM Switches

Sun and Microsoft may compete bitterly in the Internet server marketplace, but to eradicate a new and rapidly spreading malicious worm, Sun Solaris and Microsoft IIS administrators will have to cooperate closely, security experts said Tuesday.

The CERT Coordination Center Tuesday warned of a new self-propagating program, which it has dubbed the sadmind/IIS worm. Using a well-known vulnerability in each operating system, the worm turns a Sun Solaris server into a robot which silently sniffs out Windows NT or 2000 systems running IIS and defaces their home pages.

CERT's Shawn Hernan said that by mid-day Monday, more than 30 Solaris system operators had reported being infected by the worm, which exploits a buffer-overflow bug in a Solstice component known as sadmind to gain root-level control of the server. Initially unbeknownst to their operators, the infected Sun machines had run a script which uses a well-known vulnerability known as Unicode to compromise more than 2,000 remote IIS servers. Using log files created by the worm on the Solaris host, the Internet security reporting center has begun contacting system administrators of the compromised Windows systems.

The sadmind/IIS worm propagates from an infected Solaris machine by probing port 80 on a random Class B set of IP addresses, looking for the signature of other Solaris or IIS web servers. Should it find another vulnerable Solaris machine, the worm will upload its attack tool, root.exe, and infect the server.

If it finds an unpatched system running Microsoft's IIS 4.0 or IIS 5.0, the worm defaces the server, replacing its index.html file with three lines of text that reads: "fuck USA Government. fuck PoizonBOx. contact:sysadmcn@yahoo.com.cn." After defacing 2,000 IIS systems, the worm will deface its Solaris host with the same message.

The sadmind/IIS worm doesn't destroy data on either the Solaris host or IIS victims, but CERT's Hernan said the worm could open Solaris systems to subsequent attacks. According to Hernan, the quick spread of the worm suggests many Solaris systems have not applied the patch released by Sun on December 29, 1999.

"We're a little surprised at the number of systems that are being compromised by this. But you can imagine it would be easy for Solaris administrators to overlook that patch given all the Y2K concerns at the time. So that might explain the fact that it's 18 months old but hasn't been addressed widely."

CERT's advisory lists several ways that Solaris administrators can determine whether their systems have been infected with the worm, such as the existence of suspicious processes and directories created by the worm. The security center urges operators to attempt to contact operators of IIS servers listed in the log file stored in the directory /dev/cub.

Similarly, admins of compromised IIS web servers should attempt to identify and contact the operator of the Solaris host which propagated the worm by reviewing their IIS log files for GET requests for the file root.exe, according to CERT.

"We encourage administrators to contact the other sites that have been involved. That's the fundamental advice we give people," said Hernan.