-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                   ESB-2004.0432 -- UNIRAS ALERT - 26/04
                 Malicious Software Report - Download_Ject
                               28 June 2004

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Internet Explorer
Publisher:              UNIRAS
Operating System:       Windows
Impact:                 Execute Arbitrary Code/Commands
Access Required:        Remote

Ref:                    ESB-2004.0266
                        ESB-2004.0268

- --------------------------BEGIN INCLUDED TEXT--------------------

- - ----------------------------------------------------------------------------------
      UNIRAS (UK Govt CERT) ALERT - 26/04 dated 25.06.04  Time: 11:58  
 UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- - ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- - ----------------------------------------------------------------------------------

Title
=====
Malicious Software Report: 
IIS 5.0, a component of Win 2kServer being exploited by malware known as Download_Ject

Detail
====== 
Microsoft are investigating a report that some customers using IIS 5.0 (Internet 
Information Services), a component of Windows 2000 Server, are being exploited by 
malware known as Download_Ject.  Early indications are that IIS 5.0 Servers that 
have not been updated with security update MS04-011 are possibly under attack.  
Customers should ensure they have installed MS04-011 to be secure from the issues 
addressed in that security update.

Microsoft also has confirmed that this malware seeks to alter Web pages offered by 
an IIS 5.0 Server which in turn exploits vulnerabilities in Internet Explorer and 
delivers malicious code to visitors of an affected Web site.  Internet Explorer 
customers should download and deploy MS04-013 to ensure they have the most recent 
security updates for IE.

URL:
http://www.microsoft.com/security/incident/download_ject.mspx

- - ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Microsoft Corporation for the 
information contained in this Briefing. 
- - ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- - ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQN+n9Sh9+71yA2DNAQKNWQP+L8MEVd4NrCDQVH8bPpldF3FcQv/ihQMR
8D0fXs6wOpny2cDAVgRkv9dQNmVBsz73L7dgpZutjJ9YQCKj4ZNzf9VgQ84jjxW2
IE5MD98MqBu5IKkzF7+TOyiFhAKO/IKi24ldF3MWHd+vBRNwIXbZFjjzyU7gP0Ij
1b1KtQ6SncM=
=Qegb
-----END PGP SIGNATURE-----