-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
            AUSCERT External Security Bulletin Redistribution
                                    
     ESB-1999.069 -- IBM-ERS Security Vulnerability Alert #1999:001.1
              Melissa virus being distributed in .RTF files
                                    
                               27 May 1999

===========================================================================

The IBM Emergency Response Service has released the following alert
concerning an additional distribution method for the Melissa virus.

- ---------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - --ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--
- - ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---

                  =======  ============    ======       ======
                  =======  ==============  =======     =======
                    ===      ===     ====    ======   ======
                    ===      ===========     ======= =======
                    ===      ===========     === ======= ===
                    ===      ===     ====    ===  =====  ===
                  =======  ==============  =====   ===   =====
                  =======  ============    =====    =    =====

                           EMERGENCY RESPONSE SERVICE
                          SECURITY VULNERABILITY ALERT

22 May 1999 12:00 GMT                            Number: ERS-SVA-E01-1999:001.1
===============================================================================
                             VULNERABILITY  SUMMARY

VULNERABILITY:  Melissa virus being distributed in .RTF files

PLATFORMS:      Machines with Microsoft Word 97 or Word 2000

SOLUTION:       Make sure your antivirus software scans files whose names have
		.RTF extensions

THREAT:         Mail handling systems could experience severe loading problems
		as a result of this virus' propagation

===============================================================================
                              DETAILED INFORMATION

I. Description

The W97M.Melissa.A macro virus caused widespread problems in March, 1999 by
overloading organizations' electronic mail handling systems as a result of
its propagation.  Among other actions, the virus redistributes itself by
sending a copy of itself (via the infected Word document) to the first 50
addresses in each of the user's MAPI address books.  If any of these
addresses are mailing lists, the total number of recipients could be much
higher.

IBM has learned that the W97M.Melissa.A virus is again being distributed,
this time in a Word document whose file name extension is ".RTF".  These
documents are not really RTF files, but actually Word files whose file
extension has been changed.  Unfortunately, many users' virus scanners are
not configured to scan ".RTF" files by default, which could result in the
virus not being detected.

NOTE: THIS IS NOT A NEW VARIANT OF THE MELISSA VIRUS.

II. Impact

The potential impact of this document, if received and opened on a system
whose antivirus software cannot detect it, may be as serious as the impact of
the original Melissa virus outbreak in your organization.  For complete
information on the impact of the Melissa virus, consult

    http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html

III. Platform-Specific Threats

In order to successfully propagate, the infected document must be opened with
Microsoft Word 97 or Word 2000 on a system that also has Microsoft Outlook
installed.  HOWEVER, Microsoft Outlook does NOT have to be the mailer used to
read the message.

IV. Solutions

All major antivirus software vendors released signature updates to detect the
W97M.Melissa.A virus in March, 1999.  Make sure that your antivirus software
has the latest signature updates from your vendor.

Make sure that your antivirus software is configured to scan files with the
".RTF" extension.  Some antivirus programs do NOT scan these files by
default, and may require action by you to do so.  Follow the instructions
provided with your antivirus software to add the ".RTF" extension to the list
of file types scanned.

V. Acknowledgements

IBM-ERS would like to thank the Symantec AntiVirus Research Center for
providing some of the information used in this advisory.

===============================================================================

IBM's Internet Emergency Response Service (IBM-ERS) is a subscription-based
Internet security response service that includes computer security incident
response and management, regular electronic verification of your Internet
gateway(s), and security vulnerability alerts similar to this one that are
tailored to your specific computing environment.  By acting as an extension
of your own internal security staff, IBM-ERS's team of Internet security
experts helps you quickly detect and respond to attacks and exposures across
your Internet connection(s).

As a part of IBM's Business Recovery Services organization, the IBM Internet
Emergency Response Service is a component of IBM's SecureWay(tm) line of
security products and services.  From hardware to software to consulting,
SecureWay solutions can give you the assurance and expertise you need to
protect your valuable business resources.  To find out more about the IBM
Internet Emergency Response Service, send an electronic mail message to
ers-sales@ers.ibm.com, or call 1-800-599-9950.

IBM-ERS maintains a site on the World Wide Web at http://www.ers.ibm.com/.
Visit the site for information about the service, copies of security alerts,
team contact information, and other items.

IBM-ERS uses Pretty Good Privacy* (PGP*) as the digital signature mechanism for
security vulnerability alerts and other distributed information.  The IBM-ERS
PGP* public key is available from http://www.ers.ibm.com/team-info/pgpkey.html.
"Pretty Good Privacy" and "PGP" are trademarks of Philip Zimmermann.

IBM-ERS is a Member Team of the Forum of Incident Response and Security Teams
(FIRST), a global organization established to foster cooperation and response
coordination among computer security teams worldwide.

Copyright 1999 International Business Machines Corporation.

The information in this document is provided as a service to customers of
the IBM Emergency Response Service.  Neither International Business Machines
Corporation, nor any of its employees, makes any warranty, express or implied,
or assumes any legal liability or responsibility for the accuracy, complete-
ness, or usefulness of any information, apparatus, product, or process
contained herein, or represents that its use would not infringe any privately
owned rights.  Reference herein to any specific commercial products, process,
or service by trade name, trademark, manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation or favoring
by IBM or its subsidiaries.  The views and opinions of authors expressed
herein do not necessarily state or reflect those of IBM or its subsidiaries,
and may not be used for advertising or product endorsement purposes.

The material in this security alert may be reproduced and distributed,
without permission, in whole or in part, by other security incident response
teams (both commercial and non-commercial), provided the above copyright is
kept intact and due credit is given to IBM-ERS.

This security alert may be reproduced and distributed, without permission,
in its entirety only, by any person provided such reproduction and/or
distribution is performed for non-commercial purposes and with the intent of
increasing the awareness of the Internet community.

- - ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---
- - --ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--

- -----BEGIN PGP SIGNATURE-----
Version: 2.7.1

iQCVAwUBN0akgfWDLGpfj4rlAQHzeAP8D14GmRproljO2O3H4bFPU6uNBzo0kCHD
+MHc3/DfFbd5moddVkY/1QWKPTcinScjQWGcMH0yctcKT1Wy52Y6h5zd5SbpaPUH
WcXSEWpBytKRQMq+goLjXtgKoNJaQEfLkTdojhIqhtVF1MHIQXdmRTht8f9OZ3ZN
10qPqIHQvxk=
=GC4L
- -----END PGP SIGNATURE-----

- ---------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It will
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBN25h6Ch9+71yA2DNAQH0PgP/W2JUkKH7SsAFWdhtAKVKKHRAE0szk4aP
DzXYE30oC3+VxO71Szx6eoAL7PO98EiqcQ46q4VOX5giJGJOpa1k5RbRCA8i+WHN
cRKA4dx60GdDO/+u6UMNfqycipoLC07ciZVTZJdmW+jiLTK0ww0Rg/Eoe5xX9eVe
MYEIZj6PJ3M=
=gGiA
-----END PGP SIGNATURE-----