Subj : Bugbear.A virus notes
To   : MIKE LUTHER
From : MIKE RUSKAI
Date : Mon Oct 14 2002 02:08 am

Mike Luther saw fit to emit the following to David Noon
on 10-03-02  23:40 about Bugbear.A virus notes...

 ML> Yes Dave..
 
 DN> According to that report, the virus requires M$ Lookout (or a user who 
 DN> is as brain-dead as Lookout) to be activated, as it is 
 DN> transported as a mail attachment. The mail message is 
 DN> the Trojan, I suppose. The size of the executable 
 DN> attachment is always 50,688 bytes. [A "virus" the size 
 DN> of an elephant!]
 
 DN> Unless you are running Lookout, there should be no 
 DN> real threat to an OS/2 box. [Assuming the BBC is 
 DN> correct.]

[snip]
 ML> The point is that NIMDA.A, a similar sort of approach, before the
 ML> entire attack profile of the creation was propagated, *WAS* able to
 ML> download READ.ME and so on actually into the OS/2 box into various
 ML> directories. 
[snip]

The GUEST account has no access to any shares in OS/2 unless you explicitly 
grant it access.  In other words, there's no vulnerability unless you take 
specific actions to create one.

Mike Ruskai
thanny@netcarrier.com


.... Humor is the ability to laugh at ourselves.

___ Blue Wave/QWK v2.20
--- Platinum Xpress/Win/WINServer v3.0pr5
 * Origin: FidoTel & QWK on the Web! www.fidotel.com (1:275/311)

.