Antivirus: August 2004 Archives

iDefense announced today a vulnerability in AOL Instant Messenger. It seems there is a buffer overflow in the Away Message feature which at best will cause a denial of service condition, at worst will allow an attacker to run code of their choice.

Since AIM hooks the browser allowing the user to use aim:// commands like http:// commands, this is exploitable by links you might follow and by remote websites.

When an I.T department loses control of its computers often the first sign is personal use IM clients showing up. Many companies dont have the fortitude to fight that battle. Now as a result there is the potential for a network worm exploiting this vulnerability.

A new version of bagel came out today, and whether it was a result of heavy seeding or the virus had actually spread, we got a lot of copies of it. The first copy of it was detected at 11:54 am although I didn't notice until about an hour later.

Fortuantely the virus was caught by Message Labs. The virus writer was using a javascript exploit that several AV venders were already detecting (you'd think they'd scan these things before releasing them).

There are several lessons to be learned from this. They are the same lessons that aren't learned each time a virus comes out. The additctive virus definition update model doesn't work all that well. If you are going to use it, you are better off using several vendors. While CA and McAfee could detect this virus with no updates, other vendors didn't have an update available for more than 3 hours. By using several layers with a different vendor at each layer, you have a good chance of catching new viruses. If you dont have effective email antivirus, you need to cripple your own systems, pretty much reducing email to text only in order to avoid virus infection.