full-disclosure - RE: DCOM Exploit MS03-026 attack vectors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: jeff.t.parker at hp.com (Parker, Jeff (MSE))
Subject: RE: DCOM Exploit MS03-026 attack vectors

Please do not forget port 593/tcp and 593/udp.

If you (or someone else) heard something about the vulnerability working
over http (rumored to 80/tcp), port 593 is what you should be aware of.
The DCOM vuln is indeed usable over port 593.

-----Original Message-----
From: Jasper Blackwell [mailto:jasper599@...mail.com] 
Sent: Friday, August 01, 2003 1:51 AM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] RE: DCOM Exploit MS03-026 attack vectors

Hi All,

>Microsoft owns up to the exploit being usable on 135, 139 and 445, I
have 
>heard rumors of port 80  being vulnerable as well. I was curious as to 
>whether anyone had seen anything using a port other than 135?
Everything I 
>have seen discussed here and elsewhere has been 135 specific.
>
>Thanks,
>
>Paul Tinsley

I have no more information as yet, expect to say that I saw someone
asking a 
similar question somewhere else and they asked whether the RPC_CONNECT 
method could be used in HTML to spread this. Now I am not an HTML
programmer 
let alone a C programmer so I have no idea whether that is feasible or
not. 
However I would be very interested if it is as it could make a big 
difference to all of us. So any of the more knowledgable people out
there, 
is there anyway that comes to mind that this exploit could work over
port 
80? What about other programs that use DCOM and listen on other ports,
are 
they vulnerable in theory? Would it require entirely new exploitcode for

each package/port to be exploited?

By the way I am not asking for an exploit, I am neutral in the whole
debate, 
just someone who knows what they are talking about to give us an idea of

whether this thing is ever going to work over ports other then 135.

Jasp

_________________________________________________________________
Hotmail messages direct to your mobile phone
http://www.msn.co.uk/msnmobile

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html