ACL for Sasser Worm

[j.beckner]

I was working on a client's network today. Its a college campus with 4507 at the core and mutlitple buildings with about a dozen VLAN Some of the student labs got hit with the Sasser worm. Microsoft uses TCP port 445 so we can't deny 445/TCP in the ACL for the VLAN interfaces. I did deny 5554/TCP and 9996/TCP in and out on all VLAN ACL to prevent the spread of the worm. Does anyone know if these ports are also used by Microsoft?

[Georg Pauwen]

Hello,

according to IANA, these ports are:

sgi-esphttp 5554/tcp SGI ESP HTTP

palace-5 9996/tcp Palace-5

Not sure what they are, but it does not sound like Microsoft...

Regards,

Georg

[j.beckner]

Thanks Georg, we are getting some matches on these ports but I will assume it won't interfere with the Microsoft network until we hear different. I did some more searching and came up with:

"SGI says in their Security Advisory 20040501-01-I

It has been reported thru various channel that the Sasser Worm uses the

same port 5554/tcp as SGI Embedded Support Partner (ESP) web server, which is enabled by default on current SGI IRIX and SGI Altix systems"

ftp://patches.sgi.com/support/free/security/advisories/20040501-01-I.asc

"9996 is IANA-registered for the Palace chat environment application "

So denying 5554 and 9996 should be a safe way to isolate Sasser from spreading from VLAN to VLAN.

[bruce.porter]

Microsoft ports:

http://www.microsoft.com/windows2000/techinfo/reskit/en-us/default.asp?url=/windows2000/techinfo/reskit/en-us/cnet/cnfc_por_ZQYU.asp