Alias:Net-Worm.Perl.Santy.a
Type:Worm 
Size:~4 Kbytes 
Origin: 
Date:12-21-2004 
Damage: 
VDF Version:6.29.00.28 
Danger:Low 
Distribution:Medium 

General DescriptionAffected Platforms:
- Windows 95
- Windows 98
- Windows ME
- Windows NT
- Windows 2000
- Windows XP
- Windows Server 2003

DistributionPerl/Santy is a worm, which appeared for the first time on the 21st of December. It takes advantage of a security vulnerability in the "phpBB" software in order to spread itself. For this the worm uses the Google search engine in order to find other servers, which also use the phpBB Software, that contains this security vulnerability.

The operators of the Google search engine have already reacted today and search into filters, which come out from the worm.

Technical DetailsThe worm itself is written in Perl scripting language. It searches targeted for servers, which have the phpBB software use. After it terminated the searching succesfully, it tries to take advantage of the phpBB Software security vulnerability, which is known as "Highlight Vulnerability".
(You can find more detailed information on the webseite of the producer: http://www.phpbb.com/phpBB/viewtopic.php?t=240513)

The worm is able to take advantage of the security vulnerability, so it sends its code to the affected server in 20 bytes long strings. Should one of these strings get lost on the way, the worm is no longer executable. The worm corresponds with the filename "m1ho2of" on the affected server and executes its code with the standard Perl interpretor. The worm Perl/Santy replaces all files, which have the extensions: .htm, .phtm, .shtm, .php, .asp, und .jsp with the following text:

This site is defaced!!!

NeverEverNoSanity WebWorm generation X*

(* where X is an integer number)
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .