Protection from Sasser
Juniper Networks has released signatures on IDP and AV products to protect against Sasser.
The following IDP signatures have been added to detect Sasser (A, B, C,D):
MS-RPC:NOOP-SLIDE-RPC-REQ (medium)
MS-RPC:LSASS-OVERSIZED-FRAG (critical)
MS-RPC:LSASS-MAL-OPCODE (medium)
WORM:SASSER:SHELL-COMMAND-9996 (high)
WORM:SASSER:FTP-DOWNLOAD-5554 (high)
The following AV pattern files protect against Sasser A, Sasser B, Sasser C and Sasser D
WORM_SASSER.A: 879 (1.879.00)
WORM_SASSER.D: 885 (1.885.00)
WORM_SASSER.B: 883 (1.883.00)
WORM_SASSER.C: 883 (1.883.00)
Customers should download these latest signature files to maximize protection against Sasser. For additional information about Sasser please check the following websites:
http://www.lurhq.com/sasser.html
http://secunia.com/virus_information/9142/sasser/
http://www.trendmicro.com/vinfo/