Attack on Popular Firewall Programs

If there was any doubt that crackers are more quickly figuring out how to exploit newfound security holes in popular software, take a look at Internet Security Systems' BlackICE and RealSecure. Only two weeks after security research firm EEye Digital Security informed ISS of a serious flaw in these products, a miscreant cooked up a worm dubbed Witty that isn't at all amusing (see eEye Digital Security for details).

The worm replicates by sending copies of itself to randomly scanned Internet addresses, but it infects only PCs with one of these products running. Witty gradually erases key portions of an infected PC's file system code. Though it doesn't do its damage all at once, the end result is the same. The hole is present in both desktop and server editions of the products, though not in all versions. Visit X-Force Internet Security Systems for a link to the fixes.