r00t advisory: Sunny Day Virus
07a4ecd68f097b8be9dd30270808ceee<!DOCTYPE HTML PUBLIC "html.dtd">
<HTML>
<HEAD>
<TITLE> ATTRITION Advisory Archive</TITLE>
</HEAD>
<BODY BGCOLOR="#000000" VLINK="#C0C0C0" TEXT="#FFFFFF" LINK="#FF0000" ALINK="#FF0000">
<PRE>
r00t VIRUS advisory [ Sunny Day Virus ]
-- Synposis This is the first known, widely distributed virus, for
SunOS/Solaris machines running on SPARCstations and SPARC clones. The
virus runs as root and corrupts various critical kernel tables at
seemingly random intervals.
The virus is believed to enter machines through various holes in sendmails
version 8.6.9 + (Including the 8.7.x line of sendmail). Once having
entered a system the virus mutates as it infects each file.
-- Detecting the virus The virus does leave noticeable trails. At hourly
intervals it will make a random /usr/bin binary suid root. Upon
each chmod 4755 it performs the last program it 4755'd will be restored to
it's orginal permissions.
-- Removing the virus r00t recommends a complete OS reinstallation.
-- Preventing the virus The virus can be prevented by downgrading to a
version of sendmail older than 8.6.9 or by not running sendmail at all. As
far as we've deteced so far, the virus does not attempt to enter through
any other remote services.
r00t -- giving it all away.
</PRE>
</BODY>
</HTML>
© 2012 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
Comments
No comments yet, be the first!