full-disclosure - DCOM RPC exploit (dcom.c)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.43.0307281042560.2029-100000@tundra.winternet.com>
From: dufresne at winternet.com (Ron DuFresne)
Subject: DCOM RPC exploit  (dcom.c)

	[SNIP]

>
> What fingerprinting?  If you've got 135/UDP open to the Internet, you're
> screwed.  Slammer didn't fingerprint.  It simply hit every box it could
> find on port 1434/UDP, and the exploit either worked or it didn't.  Most
> worms do the same.  They attack indiscriminately, and infect those Oses
> that are susceptible.  And with Windows, that's enough boxes to cause a
> real problem.
>

And those sites during slammer that blocked 1434, as was advised when the
patch was made available, though it was advised even long before that,
were largely unafected.  Sites that are properly blocking 135 and it's
protocolcs will most likely be unaffected from any new worm wishing to
exploit this repeat problem with DCOM/RPC.

Thanks,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.