full-disclosure - File versions [was: Probable new MS DCOM RPC worm for Windows]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <OF250BDE8F.28774BA8-ON80256DAD.005E92DD-80256DAD.005EF72C@lexicon.co.uk>
From: mike.keighley at adarelexicon.com (mike.keighley@...relexicon.com)
Subject: File versions [was: Probable new MS DCOM RPC worm for Windows]

"Neis, Mark" <Mark.Neis@...iam.de> on Fri, 26 Sep 2003 16:52:16 +0200 
wrote:

> Afaik, the fix for MS03-26 changes following DLLs:
>   ole32.dll  (5.0.2195.6769)
>   rpcrt4.dll  (5.0.2195.6753)
>   rpcss.dll  (5.0.2195.6769)

> Btw: If I'm not mistaken that's also the versions that are contained
> in W2kSP4.

>From a W2kSP4 machine with no further hotfixes (except qfecheck, IE & VM):
   ole32.dll  (5.0.2195.6692)
   rpcrt4.dll (5.0.2195.6701)
   rpcss.dll  (5.0.2195.6702)

> The following fix for MS03-29 changes the same DLLs to these versions:
>   ole32.dll   (5.0.2195.6810) 
>   rpcrt4.dll   (5.0.2195.6802)
>   rpcss.dll   (5.0.2195.6810)