full-disclosure - More for the grist mill (or bad news for admins)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <871080DEC5874D41B4E3AFC5C400611E06B47630@UTDEVS02.campus.ad.utdallas.edu>
From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: More for the grist mill (or bad news for admins)

I've been doing some research on DCOM to try to figure out whether it's
even practical to disable it.  Turns out that SMS uses DCOM, so it
that's how you're distributing patches, you *probably* don't want to
disable DCOM.  It appears that Group Policies also use DCOM as does the
Management Snap-ins and possibly SUS (it's difficult to confirm that on
MS's site, but I'd be surprised if they don't), so disabling DCOM means
you might as well stop using Windows entirely.  (Not that that would be
a *bad* thing, but for many of us it's simply not an option.)

One more thing.  If you disable DCOM, it can only be reenabled on the
box.  You've lost Remote Admin access, so you're going to have to
physically touch the box to reenable.  (See the Q article:
<http://support.microsoft.com/default.aspx?scid=kb;en-us;823980>

See this page for SMS using DCOM:
<http://support.microsoft.com/default.aspx?scid=kb;en-us;215015>

SUS uses "Windows Update technology" to determine if a patch is needed.
So much for patching accurately with SUS.  (As I pointed out in a post
yesterday, checking the registry for a Q article install proves nothing.
The files could have been overwritten later with unpatched versions.)
See this article:
<http://www.microsoft.com/windows2000/windowsupdate/sus/suscomponents.as
p>

A bunch of tech articles may be found here:
<http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dndcom
/html/msdn_dcomarch.asp>

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/