Third slapper worm hits the street

Barely 24 hours after the Slapper B worm started to show up on antivirus monitoring stations, a new variant has cropped up.

According to security specialist ISS, Slapper C has infected 1,500 servers already and is spreading, although a source point has not been identified at this time.

The company warned that the source code for Slapper has spread quickly among the underground community, and will be the development platform of choice for future attacks.

Slapper and its variants exploit a vulnerability in the Secure Sockets Layer 2.0 of Apache web servers using distributions from Red Hat, Mandrake, SuSE, Gentoo and Slackware. Its suspected creator was arrested in the Ukraine on Wednesday.

"We're still analysing this but it doesn't look to be significantly different from the B variant," said Jack Clark from Network Associates' AVERT monitoring centre.

"Get your Apache systems patched and update your antivirus software and you should be fine."

A patch for all current variants is available from distributors.