The Patching Friars' AlmanacA calendar of CVE saints
BlasterHoly card for d-blaster, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 TCP 135 Blaster REBOOTO ERGO SUM
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Circle I · Worms

The Demon Blaster, Who Rebooted Without Rest

Legend

In August 2003 a worm exploited a buffer overflow in the Windows DCOM RPC interface and put millions of users in front of the same countdown: the system would reboot, then again, and again. Its code carried a message for Bill Gates and it was programmed to flood windowsupdate.com, the very place of healing. It is partly thanks to it that Windows XP SP2 turned the firewall on by default.

Exorcism

Cast it out by patching promptly, as with MS03-026. Turn on the host firewall and block RPC/DCOM (TCP 135) from every untrusted network: the service was meant to talk to the neighbours, not the whole Internet.

Technical record

Also known as
MSBlast, Lovesan, Lovsan
Circle
Circle I · Worms
First seen
2003
Status
Dormant
Weapons (exploited CVEs)
Saint RPC DCOM (Blaster)
Works
The Scourge of Blaster, the Rebooter

A worm that spread in August 2003 by exploiting a buffer overflow in the Windows DCOM RPC interface, causing repeated reboots on infected machines. It carried a message to Bill Gates and was programmed to flood windowsupdate.com. It pushed Microsoft toward enabling the Windows Firewall by default in XP SP2.

Sources: en.wikipedia.org · nvd.nist.gov

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.