bugtraq - RE: [LSD] Critical security vulnerability in Microsoft Operating Systems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <E9A01F52DC939448BBDE44ED2E1C468F2407FA@muskie.rc.on.ca>
Date: Fri, 18 Jul 2003 18:35:23 -0400
From: "Russ" <Russ.Cooper@...on.ca>
To: "Todd Sabin" <tsabin@...or.bindview.com>,
	"Last Stage of Delirium" <contact@...-pl.net>,
	<bugtraq@...urityfocus.com>
Subject: RE: [LSD] Critical security vulnerability in Microsoft Operating Systems

----
o ncacn_http   : if active, listening on TCP port 593.

Finally, if ncacn_http is active, and COM Internet Services is
installed and enabled, which is NOT the default in any configuration
I'm aware of, then you can also talk to the endpoint mapper over port
80.  Just to be clear, I think this is a very uncommon scenario, but
the possibility does exist.
----

Microsoft list RPC over HTTP as a mitigator. I checked with them and they've confirmed that it isn't vulnerable. Therefore fear of attacks via TCP 80, or against COM+, are IMO unfounded.

Further, what's the likelihood that a machine will have TCP139 or 445 open and not have TCP135 open too? While its certainly realistic to state attacks could come via named pipes, I personally think its unlikely. Given all of the activity we have on those ports already, none of it using named pipes, I'd think we'd have seen something else use them before now.

Cheers,
Russ - NTBugtraq Editor