full-disclosure - [normal] Re: MS RPC remote exploit. What about DCOMbobulator?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3F85881D.2070701@topsight.net>
From: opticfiber at topsight.net (opticfiber)
Subject: [normal] Re: MS RPC remote exploit. What about
 DCOMbobulator?

It's come to my attetion that disablinf DCOM in windows is near 
impossible without a regedit. Hopefully no one's already posted this to 
the list, if so my appologies for the redundancy. Steve Gibson from 
grc.com creates lots of tiny little applications to tighten up windows 
security. One of his latestest programs disables the DCOM service all 
together, no need for a patch. This might be a better option rather then 
just a patch, espcially for users who don't utilize this service. The 
tool can be found at the following URL: http://grc.com/dcom/

William Reyor
Http://www.topsight.net

Patrick Brauch wrote:

>On Thu, 9 Oct 2003, Sudharsha Wijesinghe wrote:
>
>  
>
>>According to MS there cant be any Remote exploit on MS RPC except for a
>>DOS attack using 139/135/445.
>>    
>>
>
>Where did they say so?
>
>http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-039.asp
>
>"Impact of vulnerability: Three new vulnerabilities, the most serious of
>which could enable an attacker to run arbitrary code on a user\x{2019}s
>system."
>
>cheers,
>  
>