Sadmind

{{infobox computer virus

| Fullname = Sadmind

| Image =

| Common name = Backdoor Sadmind| Technical name =

| Aliases =

• sadmind/IIS
• Worm.PoizonBox{{cite web|title=Sadmind|url=http://www.f-secure.com/v-descs/sadmind.shtml|publisher=F-secure|accessdate=9 February 2013|archive-date=16 July 2012|archive-url=https://web.archive.org/web/20120716181843/http://www.f-secure.com/v-descs/sadmind.shtml|url-status=live}}

| Family =

| Classification =

| Type = Computer worm

| Subtype =

| IsolationDate =

| Origin = China

| Author =

| Ports used =

| OSes =

• Sun Microsystems Solaris{{cite web |title=CERT Advisory CA-2001-11: sadmind/IIS Worm |url=https://resources.sei.cmu.edu/asset_files/WhitePaper/2001_019_001_496192.pdf#page=69 |website=Carnegie Mellon University Software Engineering Institute |archive-url=https://web.archive.org/web/20011107035310/http://www.cert.org/advisories/CA-2001-11.html |archive-date=2001-11-07 |access-date=5 October 2019 |url-status=unfit}}
• Microsoft IIS{{cite web|title=Microsoft IIS and PWS Extended Unicode Directory Traversal Vulnerability|url=http://www.securityfocus.com/bid/1806|publisher=Security Focus|accessdate=9 February 2013|archive-date=10 October 2012|archive-url=https://web.archive.org/web/20121010043157/http://www.securityfocus.com/bid/1806|url-status=live}}

| Filesize =

| Language = English

}}

The Sadmind worm was a computer worm which exploited vulnerabilities in both Sun Microsystems' Solaris ([https://web.archive.org/web/20060314112908/http://sunsolve.sun.com/search/document.do?assetkey=1-22-00191-1 Security Bulletin 00191], CVE-1999-0977) and Microsoft's Internet Information Services ([https://web.archive.org/web/20040503200424/http://www.microsoft.com/technet/security/bulletin/MS00-078.mspx MS00-078], CVE-2000-0884), for which a patch had been made available seven months earlier. It was discovered on

May 8, 2001.{{cite web|title=Backdoor.Sadmind|url=http://www.symantec.com/security_response/writeup.jsp?docid=2001-050808-4913-99|archive-url=https://web.archive.org/web/20070211015404/http://www.symantec.com/security_response/writeup.jsp?docid=2001-050808-4913-99|url-status=dead|archive-date=February 11, 2007|publisher=Symantec|accessdate=9 February 2013}}

Specifically, the virus affected the sadmind daemon on Solaris systems which had sadmind enabled in inetd.conf, since the sadmind daemon normally ran with root privileges.{{Cite web |title=Security Issue Involving the Solaris sadmind(1M) Daemon |url=https://download.oracle.com/sunalerts/1000778.1.html |access-date=2024-05-23 |website=download.oracle.com |archive-date=2016-10-18 |archive-url=https://web.archive.org/web/20161018004201/http://download.oracle.com/sunalerts/1000778.1.html |url-status=live }}

The worm defaced web servers with a message against the United States government"[https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Unix~SadMind.aspx Unix/SadMind - Worm - Sophos threat analysis] {{Webarchive|url=https://web.archive.org/web/20211021120947/https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Unix~SadMind.aspx |date=2021-10-21 }}". Accessed January 13, 2008. and the anti-Chinese cracking group PoizonBOx.Raiu, Costin. "[http://www.noh.ro/craiu.com/papers/papers/sadmind.html One Sad Mind] {{Webarchive|url=https://web.archive.org/web/20050522221923/http://www.noh.ro/craiu.com/papers/papers/sadmind.html |date=2005-05-22 }}". Accessed January 13, 2008.