{"data":{"case":{"actions":{"de":["Installiere Microsofts Update **MS03-039** (KB824146) auf jedem Computer, auf dem noch Windows NT 4.0, 2000, XP oder Server 2003 läuft. Es enthält den Fix aus MS03-026 und schließt drei weitere Lücken im selben Dienst.","Wenn du es nicht sofort installieren kannst, schalte **DCOM** ab, wie im Microsoft-Artikel KB825750 beschrieben. Programme, die DCOM über das Netzwerk nutzen, funktionieren dann nicht mehr.","Sperre die TCP-Ports **135, 139, 445 und 593** sowie die UDP-Ports 135, 137, 138 und 445 in deiner Firewall, damit niemand RPC aus dem Internet erreichen kann.","Ersetze diese alten Windows-Versionen: Sie erhalten keine regelmäßigen Sicherheitsupdates mehr."],"en":["On any computer that still runs Windows NT 4.0, 2000, XP or Server 2003, install Microsoft's update **MS03-039** (KB824146). It contains the fix from MS03-026 and closes three more flaws in the same service.","If you cannot install it at once, switch off **DCOM** as described in Microsoft article KB825750. Programs that use DCOM across the network then stop working.","Block TCP ports **135, 139, 445 and 593** and UDP ports 135, 137, 138 and 445 at your firewall, so that no one can reach RPC from the internet.","Replace these old Windows versions: they no longer receive regular security updates."]},"criteria":{"damage":{"de":"Die Quellen nennen keine Gesamtsumme des Schadens und belegen keine Ausfälle kritischer Dienste. Laut einer Umfrage unter 19 Forschungsuniversitäten gab jede im Schnitt 299.579 US-Dollar für die Bereinigung aus (The Blaster Worm: Then and Now, 2005).","en":"The sources give no total of the damage and document no outages of critical services. A survey of 19 research universities found that each spent an average of USD 299,579 to recover (The Blaster Worm: Then and Now, 2005).","met":false},"exploitation":{"de":"Blaster war ein Wurm: Jeder infizierte Computer suchte neue Opfer und infizierte sie selbstständig (CERT/CC; The Blaster Worm: Then and Now, 2005).","en":"Blaster was a worm: every infected computer searched for new victims and infected them on its own (CERT/CC; The Blaster Worm: Then and Now, 2005).","met":true},"reach":{"de":"Blaster infizierte in seiner ersten Woche mehr als 100.000 Windows-Computer. Am aktivsten Tag sah ein überwachter Adressblock, der 1/256 des Internets umfasst, etwa 106.000 infizierte Adressen (The Blaster Worm: Then and Now, 2005).","en":"Blaster infected more than 100,000 Windows computers in its first week. On its busiest day, a monitored address block covering 1/256 of the internet saw about 106,000 infected addresses (The Blaster Worm: Then and Now, 2005).","met":true},"response":{"de":"Microsoft stellte seinen Patch sogar für Windows-Versionen bereit, deren Support beendet war, und nahm die angegriffene Adresse windowsupdate.com aus dem DNS. Gemeinsam mit dem FBI, dem US Secret Service und Interpol setzte Microsoft 250.000 US-Dollar Belohnung für die Urheber aus (Microsoft; SANS Internet Storm Center; US Secret Service).","en":"Microsoft provided its fix even for Windows versions whose support had ended. It took the attacked address windowsupdate.com out of the DNS. Joined by the FBI, the US Secret Service and Interpol, it offered USD 250,000 for the authors (Microsoft; SANS Internet Storm Center; US Secret Service).","met":true}},"cves":["CVE-2003-0352"],"cvss":7.5,"cvss_version":"2.0","cwe":"NVD-CWE-Other","dates":[{"date":"2003-07-16","key":"patched"},{"date":"2003-07-26","de":"Funktionierender Angriffscode erscheint auf einer öffentlichen Mailingliste","en":"Working attack code appears on a public mailing list"},{"date":"2003-07-31","key":"exploited"},{"date":"2003-08-11","key":"outbreak"},{"date":"2003-08-15","de":"Microsoft entfernt windowsupdate.com, das Angriffsziel des Wurms, aus dem DNS","en":"Microsoft takes windowsupdate.com, the target of the worm's attack, out of the DNS"},{"date":"2003-08-18","de":"Ein zweiter Wurm, Welchia, auch Nachi genannt, nutzt dieselbe Sicherheitslücke aus","en":"Welchia, also called Nachi, a second worm, uses the same flaw"},{"date":"2003-09-10","de":"Microsoft behebt mit MS03-039 drei weitere Sicherheitslücken im selben Dienst","en":"Microsoft fixes three more flaws in the same service with MS03-039"},{"date":"2003-11-05","de":"Microsoft setzt gemeinsam mit dem FBI, dem US Secret Service und Interpol 250.000 US-Dollar Belohnung für die Urheber aus","en":"Microsoft, joined by the FBI, the US Secret Service and Interpol, offers USD 250,000 for the authors"}],"de":{"credit":"The Last Stage of Delirium Research Group","fixed":"Microsoft-Patch MS03-026, KB823980 (16. Juli 2003); ersetzt durch MS03-039, KB824146 (10. September 2003)","product":"Windows NT 4.0, 2000, XP und Server 2003, über den standardmäßig laufenden RPC-Dienst","summary":"Ein Wurm infizierte über eine Lücke in einem standardmäßig laufenden Windows-Dienst binnen einer Woche mehr als 100.000 Computer. Ein Jahr später verbreitete er sich noch immer."},"disclosed":"2003-08-11","en":{"credit":"The Last Stage of Delirium Research Group","fixed":"Microsoft patch MS03-026, KB823980 (July 16, 2003); replaced by MS03-039, KB824146 (September 10, 2003)","product":"Windows NT 4.0, 2000, XP and Server 2003, through the RPC service that runs by default","summary":"Through a flaw in a Windows service that runs by default, a worm infected more than 100,000 computers in a week. A year later, it was still spreading."},"figures":[{"de":"Windows-Computer in der ersten Woche infiziert","en":"Windows computers infected in the first week","value":"100,000+"},{"de":"Verdopplungszeit der Zahl infizierter Computer in den ersten Stunden","en":"doubling time of the number of infected computers in the first hours","value":"9 min"},{"de":"Adressen verbreiteten den Wurm ein Jahr später noch immer","en":"addresses were still spreading the worm a year later","value":"200,000+"},{"de":"US-Dollar gab jede von 19 Forschungsuniversitäten im Schnitt für die Bereinigung aus","en":"US dollars spent on average by each of 19 research universities to recover","value":"299,579"}],"key":"blaster","name":"Blaster","product":"Microsoft Windows","sources":[{"de":"Microsoft-Sicherheitsbulletin MS03-026","title":"Microsoft security bulletin MS03-026","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-026"},{"de":"Microsoft-Sicherheitsbulletin MS03-039, das MS03-026 ersetzt","title":"Microsoft security bulletin MS03-039, which replaces MS03-026","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-039"},{"de":"NVD: CVE-2003-0352","title":"NVD: CVE-2003-0352","url":"https://nvd.nist.gov/vuln/detail/CVE-2003-0352"},{"de":"CERT/CC-Schwachstellenhinweis VU#568148","title":"CERT/CC vulnerability note VU#568148","url":"https://www.kb.cert.org/vuls/id/568148"},{"de":"CERT/CC-Sicherheitswarnungen von 2003, darunter CA-2003-19 und CA-2003-20 zu Blaster","title":"CERT/CC advisories of 2003, including CA-2003-19 and CA-2003-20 on Blaster","url":"https://www.sei.cmu.edu/library/2003-cert-advisories/"},{"de":"The Blaster Worm: Then and Now, IEEE Security \u0026 Privacy (2005, PDF)","title":"The Blaster Worm: Then and Now, IEEE Security \u0026 Privacy (2005, PDF)","url":"https://vhosts.eecs.umich.edu/fjgroup/pubs/blaster-ieeesp.pdf"},{"de":"Microsoft: Maßnahmen gegen Blaster und den erwarteten Angriff auf windowsupdate.com (15. August 2003)","title":"Microsoft: steps against Blaster and the expected attack on windowsupdate.com (August 15, 2003)","url":"https://news.microsoft.com/source/2003/08/15/microsoft-outlines-specific-steps-to-help-ensure-pc-security/"},{"de":"SANS Internet Storm Center: Microsoft löst windowsupdate.com nicht mehr auf (15. August 2003)","title":"SANS Internet Storm Center: Microsoft no longer resolves windowsupdate.com (August 15, 2003)","url":"https://isc.sans.edu/diary.html?storyid=27"},{"de":"US Secret Service: Microsofts Belohnungsprogramm mit den Strafverfolgungsbehörden, 250.000 US-Dollar für die Urheber von Blaster (November 2003)","title":"US Secret Service: Microsoft's reward program with law enforcement, USD 250,000 for the authors of Blaster (November 2003)","url":"https://www.secretservice.gov/press/releases/2003/11/microsoft-announces-anti-virus-reward-program-microsoft-teams-law"},{"de":"Microsoft: Allianz mit Internetanbietern und das Bereinigungstool für Blaster (Februar 2004)","title":"Microsoft: alliance with internet providers and the Blaster cleanup tool (February 2004)","url":"https://news.microsoft.com/source/2004/02/24/microsoft-builds-alliance-with-service-providers-to-advance-security-for-internet-users-worldwide/"},{"de":"Cisco-Sicherheitshinweis: Empfehlungen gegen den Nachi-Wurm (2003, Kopie aus einer Mailingliste)","title":"Cisco security notice: Nachi worm mitigation recommendations (2003, mailing-list copy)","url":"https://seclists.org/fulldisclosure/2003/Aug/1192"}],"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","year":2003}},"description":"In August 2003, the Blaster worm infected more than 100,000 Windows computers in its first week. How it spread, why it attacked Microsoft and why it stayed.","language":"en","latest_measurement":"2026-11-01","method":"latency-v3","method_page":"https://crackthe.net/data/method/","source":"https://crackthe.net/","text":"On August 11, 2003, a worm called Blaster, also known as MSBlast or Lovsan, began to spread. It used a flaw in Windows that Microsoft had fixed four weeks earlier. A worm is a program that spreads from computer to computer on its own. Blaster needed no click and no password: an unpatched Windows computer within its reach was enough. According to a measurement study, it infected more than 100,000 Windows computers in its first week. A year later, it was still spreading.\nHow it worked Windows uses a service called RPC, short for Remote Procedure Call, to let programs call functions on other computers. One part of it handles DCOM, a way for software components to work together across a network. According to Microsoft, the service runs by default in all versions of Windows. It listens on several network ports, numbered doors for network traffic, above all TCP port 135.\nOne DCOM function did not properly check incoming messages. A crafted message overflowed a memory area of fixed size, a buffer. The attacker\u0026rsquo;s code could then run with Local System privileges, the highest rights in Windows. Windows NT 4.0, 2000, XP and Server 2003 were all affected.\nBlaster reused attack code that had been published on a public mailing list in July. Each infected computer picked a starting address, in 40 % of cases one close to its own. Then it tried 20 addresses at a time on port 135. A successful attack opened a backdoor, a hidden command line, on port 4444. Through it, the new victim was told to fetch the worm file, msblast.exe, from the attacking computer and to run it. The download used TFTP, a simple file transfer method. An entry in the registry, the central settings database of Windows, restarted the worm after every reboot.\nMicrosoft warned that Blaster could make infected PCs crash again and again. CERT/CC, the US computer emergency response center at Carnegie Mellon University, reported that some machines could not stay online long enough to download the patch. The worm had a second task: on August 16, every infected computer was to flood windowsupdate.com, an address of Microsoft\u0026rsquo;s update website, with connection requests.\nInfected PCtries 20 addresses at a time on port 135 RPC servicea crafted DCOM message overflows a buffer Backdooropens a command line on port 4444 New victimdownloads msblast.exe by TFTP and runs it No click and no password were needed. Each new victim started the same steps on its own. Reach and damage The best measurements come from “The Blaster Worm: Then and Now”, a 2005 study by researchers at the University of Michigan and the security firm Arbor Networks. They watched a block of about 16 million unused internet addresses, one 256th of the internet. No real computers use them, so any traffic arriving there comes from scans, such as worms looking for victims.\nAfter Microsoft\u0026rsquo;s warning in July, the number of computers probing port 135 on this block rose from 4–10 a day to 100–300 a day. When Blaster struck, the number of infected computers at first doubled about every nine minutes. At the peak, the researchers saw nearly 15,000 infected addresses in one hour and about 106,000 in 24 hours. After eight hours, activity began to fall as owners patched or disconnected computers and networks blocked the worm. The decline had a half-life of about 12 hours.\nThe infected networks included several consumer broadband providers. Other counts differ widely:\nThree ways of counting Blaster Monitored address block, busiest day106,000 DShield firewall logs, highest count208,000 Microsoft cleanup tool, users helped8,000,000 The first two bars count internet addresses that probed port 135, the third the users whom Microsoft\u0026rsquo;s cleanup tool helped, by Microsoft\u0026rsquo;s count. Sources: The Blaster Worm: Then and Now (2005); Microsoft (2004).\nDShield is a service that collects firewall logs from tens of thousands of devices. It saw at most 208,000 addresses scanning port 135, against about 7,000 before the worm. In February 2004, Microsoft said that its cleanup tool had helped more than 8 million internet users. The researchers note that this differs widely from both measurements.\nNo reliable total of the damage exists. The study quotes a survey of 19 research universities. According to it, each spent an average of USD 299,579 over five weeks to recover from Blaster and its variants.\nOn August 18, a second worm began to use the same flaw. Welchia, also called Nachi, was meant as an “antiworm”. According to the study, it tried to patch the flaw on the computers it infected. Before each attack, it sent a ping, a small test message, to see whether a computer was online. The network equipment maker Cisco reported that the high volumes of these packets caused many of the network problems, including overloaded routers. The study concludes that Welchia caused significant damage of its own.\nThe fix and the response The research group The Last Stage of Delirium had reported the flaw to Microsoft. On July 16, 2003, Microsoft published security bulletin MS03-026 with a patch. It rated the flaw critical for every affected version of Windows and advised: “Systems administrators should apply the patch immediately.” As a stopgap, it suggested blocking the RPC ports at the firewall or switching off DCOM. No public attack code existed yet. By July 26, working attack code was on a public mailing list. On July 31, CERT/CC reported widespread scanning and exploitation.\nAfter the outbreak, Microsoft also provided its patch for Windows 2000 Service Pack 2 and Windows NT 4.0 Workstation, although their support had ended. On September 10, 2003, its bulletin MS03-039 fixed three more flaws in the same service and replaced MS03-026. For the old versions, Microsoft made an exception “due to the nature of this vulnerability”.\nMicrosoft also defused the attack on windowsupdate.com. On August 15, a day before the planned attack, it stopped resolving that address in the DNS, the address book of the internet. The SANS Internet Storm Center, which tracks internet attacks, reported this. Infected computers found nothing to attack. Windows\u0026rsquo; automatic updates, however, used windowsupdate.microsoft.com and kept working.\nOn November 5, 2003, Microsoft offered USD 250,000 for information leading to the arrest and conviction of those behind the original worm. The FBI, the US Secret Service and Interpol joined the offer. People behind two later variants had already been arrested. The author of the original was never caught, the study notes. Millions downloaded Microsoft\u0026rsquo;s cleanup tool in January 2004, but according to the study, the number of infections barely changed.\nA year later, in August and September 2004, the researchers counted more than 200,000 different addresses still spreading the worm, up to 4,100 a day. Most were new: 99.5 % of the addresses, and 73 % of the surrounding blocks of 256 addresses, had not appeared during the outbreak. The researchers conclude that the worm moved on to new computers as old ones were cleaned or switched off.\nInfected addresses seen on the busiest day August 2003106,000 August–September 20044,100 Addresses that scanned the monitored block within one day, during the outbreak and one year later. Source: The Blaster Worm: Then and Now (2005).\nThe National Vulnerability Database rates the flaw 7.5 out of 10 on the older CVSS version 2, with no score on version 3. That score assumes only partial harm to confidentiality, integrity and availability. Yet according to Microsoft, an attacker could gain complete control of the computer.","title":"Blaster: the worm that hit 100,000 Windows PCs in a week","url":"https://crackthe.net/security/vulnerabilities/blaster/"}