Solaris turkey worm talks its way through telnet flaw

Sophos is warning computer users of all operating systems of the dangers of malware, as an internet worm that displays offensive messages and cartoon images of talking turkeys is exploiting a recently announced vulnerability on Sun Solaris servers.

The Unix/Froot-A worm (also known as Wanuk) exploits a vulnerability in both x86 and SPARC versions of version 10 of Sun’s operating system, attempting to open a backdoor which could allow hackers to gain remote access to computers.

“Most attacks today are targeted at computers running Microsoft Windows, but that doesn’t mean that businesses running UNIX and other operating systems don’t need to take security seriously,” said Graham Cluley, senior technology consultant at Sophos. “This worm takes advantage of a security hole in Solaris’s Telnet service that was first disclosed last month. Vulnerable businesses would be wise to install the vulnerability fix from Sun, and consider disabling Telnet.”

Under certain conditions the Froot worm can send system broadcast messages via the ‘wall’ command. These can take a variety of forms, including ASCII art and the phrase:

‘Hi, I’m Casper, I am a bored Sun developer and I wrote this piece of code.’

One of the ASCII art messages displays an offensive message and another shows a cartoon of a talking turkey.

“However funny the talking turkey may seem, all new malware attacks are serious. However, it doesn’t seem like Sun Solaris threats will eclipse the virus problem on Windows anytime soon,” continued Cluley. “The correct response is not to panic, but to take sensible action to ensure defences are in place, and software is patched whenever a new vulnerability is announced.”