Sasser Worm Expected to Hit Hard

A new series of worms released onto the Internet exploits a critical security vulnerability in Microsoft's Windows XP and Windows 2000 operating systems and does not need users to open e-mail attachments in order to propagate, experts say.

The worm's impact is expected to peak Monday as millions of workers bring their laptops back to their offices, after using them over the weekend to access the Internet from relatively unsecured home locations.

Microsoft has rated the vulnerability exploited by the W32/Sasser A and Sasser B worms as critical. Security experts urged all users of vulnerable system to apply patches immediately.

"Successful exploitation of this issue could allow a remote attacker to execute malicious code on a vulnerable system, resulting in full system compromise," Microsoft says in a security bulletin.

Spreading Quickly

The worm has positioned itself as one of the quickest-spreading and most virulent ones around, suggesting that the number of incidents will soar at the beginning of the week, according to Luis Corrons, director of security vendor Panda Software's PandaLabs unit.

The Sasser worm works in a similar way to last year's Blaster worm, but has not yet spread so quickly, according to Graham Cluley, senior technology consultant for security vendor Sophos.

It is only capable of infecting machines running Windows XP and Windows 2000. But users who fail to protect their systems with antivirus updates, firewalls, and Microsoft's security patch are asking for trouble, Cluley says in a statement.

Computers infected with the worm boot up normally but then hang up or shut down when users attempt to do any work. The new worm exploits the LSASS (Local Security Authority Subsystem Service) remotely exploitable buffer overrun vulnerability first reported by Microsoft on April 13 in Microsoft Security Bulletin MS04-011.

The worm does not damage files and is relatively easy to remove, although concerns have been raised that information stored on an infected computer could be compromised.

New variants could appear very soon, Corrons says.