full-disclosure - [normal] Re: MS RPC remote exploit. What about DCOMbobulator?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1065721897.1793.1453.camel@bloodnok.itss.auckland.ac.nz>
From: r.fulton at auckland.ac.nz (Russell Fulton)
Subject: [normal] Re: MS RPC remote exploit. What
	about DCOMbobulator?

On Fri, 2003-10-10 at 05:09, opticfiber wrote:
> It's come to my attetion that disablinf DCOM in windows is near 
> impossible without a regedit. Hopefully no one's already posted this to 
> the list, if so my appologies for the redundancy. Steve Gibson from 
> grc.com creates lots of tiny little applications to tighten up windows 
> security. One of his latestest programs disables the DCOM service all 
> together, no need for a patch. This might be a better option rather then 
> just a patch, espcially for users who don't utilize this service. The 
> tool can be found at the following URL: http://grc.com/dcom/

Disable DCOM by all means, but also apply the patch!  I have seen
numerous cases of where services have been disable to mitigate some
security concern only to be re-enabled later (either by accident or
deliberately) leaving the machine vulnerable.

-- 
Russell Fulton, Network Security Officer, The University of Auckland,
New Zealand.