flight company Delta Air Lines having to cancel several trans-atlantic flights because its computer systems had been swamped by the worm.

The effects of Sasser include the news agency Agence France-Presse (AFP) having all its satellite communications blocked for hours and the U.S. Some technology specialists have speculated that the worm writer reverse-engineered the patch to discover the vulnerability, which would open millions of computers whose operating system had not been upgraded with the security update. The LSASS vulnerability was patched by Microsoft in the April 2004 installment of its monthly security packages, prior to the release of the worm. Several variants called Sasser.B, Sasser.C, and Sasser.D appeared within days (with the original named Sasser.A). Microsoft's analysis of the worm indicates that it may also spread through port 139. The worm scans different ranges of IP addresses and connects to victims' computers primarily through TCP port 445. This worm was named Sasser because it spreads by exploiting a buffer overflow in the component known as LSASS ( Local Security Authority Subsystem Service) on the affected operating systems. The most characteristic experience of the worm is the shutdown timer that appears due to the worm crashing LSASS. The specific hole Sasser exploits is documented by Microsoft in its MS04-011 bulletin, for which a patch had been released seventeen days earlier. Thus it is particularly virulent in that it can spread without user intervention, but it is also easily stopped by a properly configured firewall or by downloading system updates from Windows Update. Sasser spreads by exploiting the system through a vulnerable port. Sasser is a computer worm that affects computers running vulnerable versions of the Microsoft operating systems Windows XP and Windows 2000.

JSTOR ( May 2015) ( Learn how and when to remove this template message).

Unsourced material may be challenged and removed.įind sources: 'Sasser' computer worm – news

Please help improve this article by adding citations to reliable sources.

Korgo worm virus