Sasser worm expected to hit hard on Monday

A new series of worms released onto the Internet exploits a critical security vulnerability in Microsoft's Windows XP and Windows 2000 operating systems and does not need users to open e-mail attachments in order to propagate, experts said Saturday.

The worm's impact is expected to peak Monday as millions of workers bring their laptops back to their offices, after using them over the weekend to access the Internet from relatively unsecured home locations.

Microsoft has rated the vulnerability exploited by the W32/Sasser A and Sasser B worms as critical and security experts urged all users of vulnerable system to apply patches immediately.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

A new series of worms released onto the Internet exploits a critical security vulnerability in Microsoft's Windows XP and Windows 2000 operating systems and does not need users to open e-mail attachments in order to propagate, experts said Saturday.

The worm's impact is expected to peak Monday as millions of workers bring their laptops back to their offices, after using them over the weekend to access the Internet from relatively unsecured home locations.

Microsoft has rated the vulnerability exploited by the W32/Sasser A and Sasser B worms as critical and security experts urged all users of vulnerable system to apply patches immediately.

"Successful exploitation of this issue could allow a remote attacker to execute malicious code on a vulnerable system, resulting in full system compromise," Microsoft has said in a security bulletin.

The worm has positioned itself as one of the quickest-spreading and most virulent ones around, suggesting that the number of incidents will soar at the beginning of the week, according to Luis Corrons, director of security vendor Panda Software SL's PandaLabs unit.

The Sasser worm works in a similar way to last year's Blaster worm, but has not yet spread so quickly, according to Graham Cluley, senior technology consultant for security vendor Sophos PLC.

It is only capable of infecting machines running Windows XP and Windows 2000. But users who fail to protect their systems with anti-virus updates, firewalls and Microsoft's security patch are asking for trouble, Cluley said in a statement.

Computers infected with the worm boot up normally but then hang up or shut down when users attempt to do any work. The new worm exploits the Local Security Authority Subsystem Service (LSASS) remotely exploitable buffer overrun vulnerability first reported by Microsoft on April 13 in Microsoft Security Bulletin MS04-011.

The worm does not damage files and is relatively easy to remove, although concerns have been raised that information stored on an infected computer could be compromised.

New variants could appear very soon, Corrons said.

The IDG News Service is a Network World affiliate.