SLED10 : Viruses and Worms

This document (3806712) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Desktop 10

Situation

Concern has been raised about a specific virus or worm, such as the MS.Blaster.worm, as it pertains to the Linux Desktop.

Resolution

If concerned about viruses and worms on a network, it may be advisable to run AppArmor or Security Enhanced Linux to prevent buffer underrun and buffer overrun vulnerabilities.

However, if these software packages are not available, an administrator can research threats on a network to understand what operating systems can be compromised and which ones cannot.

Before one can clearly identify whether or not a worm or virus effects a specific operating system, the individual must research that specific threat and how that threat compromises systems.

For example, the MS.Blaster.worm compromises systems using a Microsoft Windows specific threat, a DCOM buffer overflow that results in a workstation or server with this vulnerability retrieving an msblast.exe from the infecting computer and then running the program to infect other computers. As a result, SUSE Linux Enterprise Desktops (which do not encounter the same vulnerability) are not susceptible to this particular virus.

Each threat must me examined in order to determine how much of a threat it is.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.