-----BEGIN PGP SIGNED MESSAGE----- - --ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT-- - ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE--- ======= ============ ====== ====== ======= ============== ======= ======= === === ==== ====== ====== === =========== ======= ======= === =========== === ======= === === === ==== === ===== === ======= ============== ===== === ===== ======= ============ ===== = ===== EMERGENCY RESPONSE SERVICE SECURITY VULNERABILITY ALERT 22 May 1999 12:00 GMT Number: ERS-SVA-E01-1999:001.1 =============================================================================== VULNERABILITY SUMMARY VULNERABILITY: Melissa virus being distributed in .RTF files PLATFORMS: Machines with Microsoft Word 97 or Word 2000 SOLUTION: Make sure your antivirus software scans files whose names have .RTF extensions THREAT: Mail handling systems could experience severe loading problems as a result of this virus' propagation =============================================================================== DETAILED INFORMATION I. Description The W97M.Melissa.A macro virus caused widespread problems in March, 1999 by overloading organizations' electronic mail handling systems as a result of its propagation. Among other actions, the virus redistributes itself by sending a copy of itself (via the infected Word document) to the first 50 addresses in each of the user's MAPI address books. If any of these addresses are mailing lists, the total number of recipients could be much higher. IBM has learned that the W97M.Melissa.A virus is again being distributed, this time in a Word document whose file name extension is ".RTF". These documents are not really RTF files, but actually Word files whose file extension has been changed. Unfortunately, many users' virus scanners are not configured to scan ".RTF" files by default, which could result in the virus not being detected. NOTE: THIS IS NOT A NEW VARIANT OF THE MELISSA VIRUS. II. Impact The potential impact of this document, if received and opened on a system whose antivirus software cannot detect it, may be as serious as the impact of the original Melissa virus outbreak in your organization. For complete information on the impact of the Melissa virus, consult http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html III. Platform-Specific Threats In order to successfully propagate, the infected document must be opened with Microsoft Word 97 or Word 2000 on a system that also has Microsoft Outlook installed. HOWEVER, Microsoft Outlook does NOT have to be the mailer used to read the message. IV. Solutions All major antivirus software vendors released signature updates to detect the W97M.Melissa.A virus in March, 1999. Make sure that your antivirus software has the latest signature updates from your vendor. Make sure that your antivirus software is configured to scan files with the ".RTF" extension. Some antivirus programs do NOT scan these files by default, and may require action by you to do so. Follow the instructions provided with your antivirus software to add the ".RTF" extension to the list of file types scanned. V. Acknowledgements IBM-ERS would like to thank the Symantec AntiVirus Research Center for providing some of the information used in this advisory. =============================================================================== IBM's Internet Emergency Response Service (IBM-ERS) is a subscription-based Internet security response service that includes computer security incident response and management, regular electronic verification of your Internet gateway(s), and security vulnerability alerts similar to this one that are tailored to your specific computing environment. By acting as an extension of your own internal security staff, IBM-ERS's team of Internet security experts helps you quickly detect and respond to attacks and exposures across your Internet connection(s). As a part of IBM's Business Recovery Services organization, the IBM Internet Emergency Response Service is a component of IBM's SecureWay(tm) line of security products and services. From hardware to software to consulting, SecureWay solutions can give you the assurance and expertise you need to protect your valuable business resources. To find out more about the IBM Internet Emergency Response Service, send an electronic mail message to ers-sales@ers.ibm.com, or call 1-800-599-9950. IBM-ERS maintains a site on the World Wide Web at http://www.ers.ibm.com/. Visit the site for information about the service, copies of security alerts, team contact information, and other items. IBM-ERS uses Pretty Good Privacy* (PGP*) as the digital signature mechanism for security vulnerability alerts and other distributed information. The IBM-ERS PGP* public key is available from http://www.ers.ibm.com/team-info/pgpkey.html. "Pretty Good Privacy" and "PGP" are trademarks of Philip Zimmermann. IBM-ERS is a Member Team of the Forum of Incident Response and Security Teams (FIRST), a global organization established to foster cooperation and response coordination among computer security teams worldwide. Copyright 1999 International Business Machines Corporation. The information in this document is provided as a service to customers of the IBM Emergency Response Service. Neither International Business Machines Corporation, nor any of its employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, complete- ness, or usefulness of any information, apparatus, product, or process contained herein, or represents that its use would not infringe any privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by IBM or its subsidiaries. The views and opinions of authors expressed herein do not necessarily state or reflect those of IBM or its subsidiaries, and may not be used for advertising or product endorsement purposes. The material in this security alert may be reproduced and distributed, without permission, in whole or in part, by other security incident response teams (both commercial and non-commercial), provided the above copyright is kept intact and due credit is given to IBM-ERS. This security alert may be reproduced and distributed, without permission, in its entirety only, by any person provided such reproduction and/or distribution is performed for non-commercial purposes and with the intent of increasing the awareness of the Internet community. - ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE--- - --ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT-- -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAwUBN0akgfWDLGpfj4rlAQHzeAP8D14GmRproljO2O3H4bFPU6uNBzo0kCHD +MHc3/DfFbd5moddVkY/1QWKPTcinScjQWGcMH0yctcKT1Wy52Y6h5zd5SbpaPUH WcXSEWpBytKRQMq+goLjXtgKoNJaQEfLkTdojhIqhtVF1MHIQXdmRTht8f9OZ3ZN 10qPqIHQvxk= =GC4L -----END PGP SIGNATURE-----