full-disclosure - Blaster: will it spread without tftp?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: dsoeder at eeye.com (Derek Soeder)
Subject: Blaster: will it spread without tftp?

Hi Maarten,

> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Maarten
> Sent: Tuesday, August 12, 2003 1:19 PM
> To: full-disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] Blaster: will it spread without tftp?
>
[...]
>
> I also read something about SP0|1|2 on W2K not being vulnerable
> to msblaster
> (probably because of the "universal" offsets used). Is there
> anyone that can
> confirm this finding?

We've confirmed that Windows 2000 SP0-2 *are* vulnerable -- the "universal"
offset (0018759F) does work on every version of Windows 2000 we've tested,
which includes Windows 2000 Server (English) SP0-4 and Windows 2000 Pro
(Japanese), just for variety.

As far as I know, the only thing different about Windows 2000 SP0-2 in this
regard is that DCOM functionality cannot be disabled just by using DCOMCNFG.

-- Derek