The 'Security Digest' Archives (TM)

Archive: About | Browse | Search | Contributions | Feedback
Site: Help | Index | Search | Contact | Notices | Changes

ARCHIVE: 'Phage List' - Archives (1988 - 1989)
DOCUMENT: phage #015 [A cure!!!!!] (1 message, 733 bytes)
NOTICE: recognises the rights of all third-party works.


From: Gene Spafford <spaf>
To: phage
Date: Thu 22:04:15 03/11/1988 EST
Subject: A cure!!!!!
References: [Thread Prev: 385] [Thread Next: 016] [Message Prev: 012] [Message Next: 017]


Kevin ("Adb's your friend.") Braunsdorf just burst into my office
with a cure discovered in the disassembled worm binary.

If there is an external variable in the library named "pleasequit" that is
non-zero, the worm will die immediately after exiting.
Thus, to kill any new worms, include a patch in your library that
defines the symbol.  The following shell file and source code
will modify your C library to define this symbol.

It WON'T kill any currently linked and running versions, but it will
prevent reinfection.

# Shar archive.  Give the following as input to /bin/sh
#  Packed Thu Nov  3 21:56:35 EST 1988 by
#  This archive contains:
#	foo.c
echo x -
sed 's/^X//' > <<'*-**-*'
Xcc -c foo.c -o foo.o
Xcp /lib/libc.a /lib/libc.a.old
Xar q /lib/libc.a foo.o
Xranlib /lib/libc.a
echo x - foo.c
sed 's/^X//' >foo.c <<'*-*-END-of-foo.c-*-*'
Xextern int pleasequit = -1;