The 'Security Digest' Archives (TM)

ARCHIVE: 'Phage List' - Archives (1988 - 1989)
DOCUMENT: phage #015 [A cure!!!!!] (1 message, 733 bytes)
SOURCE: http://securitydigest.org/exec/display?f=phage/archive/015.txt&t=text/plain
NOTICE: securitydigest.org recognises the rights of all third-party works.

START OF DOCUMENT

From: Gene Spafford <spaf>
To: phage
Date: Thu 22:04:15 03/11/1988 EST
Subject: A cure!!!!!
References: [Thread Prev: 385] [Thread Next: 016] [Message Prev: 012] [Message Next: 017]

FLASH!!

Kevin ("Adb's your friend.") Braunsdorf just burst into my office
with a cure discovered in the disassembled worm binary.

If there is an external variable in the library named "pleasequit" that is
non-zero, the worm will die immediately after exiting.
Thus, to kill any new worms, include a patch in your library that
defines the symbol.  The following shell file and source code
will modify your C library to define this symbol.

It WON'T kill any currently linked and running versions, but it will
prevent reinfection.


# Shar archive.  Give the following as input to /bin/sh
#  Packed Thu Nov  3 21:56:35 EST 1988 by spaf@uther.cs.purdue.edu
#
#  This archive contains:
#	foo.sh
#	foo.c
#
#
echo x - foo.sh
sed 's/^X//' >foo.sh <<'*-*-END-of-foo.sh-*-*'
Xcc -c foo.c -o foo.o
Xcp /lib/libc.a /lib/libc.a.old
Xar q /lib/libc.a foo.o
Xranlib /lib/libc.a
*-*-END-of-foo.sh-*-*
echo x - foo.c
sed 's/^X//' >foo.c <<'*-*-END-of-foo.c-*-*'
Xextern int pleasequit = -1;
*-*-END-of-foo.c-*-*
exit

END OF DOCUMENT