full-disclosure - MS RPC remote exploit. What about DCOMbobulator?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <000c01c38ec7$d6b09a40$c1f2020a@genesis>
From: rbaer at innernet.net (Rob)
Subject: MS RPC remote exploit. What about DCOMbobulator?

-------- original msg -------------
Quoting opticfiber (opticfiber@...sight.net):
> 
> It's come to my attetion that disablinf DCOM in windows is near 
> impossible without a regedit.

I am no m$win expert, but I think that runing 'dcomcfng' from a DOS
shell and clicking on 'Default Properties' and clearing 'Enable Dcom on this
Computer' window is enough. No regedits, no 'tiney little applications' required.

You still need to patch the PC or install *nix on it though....
----------- end --------------

I'm not a professional or anything, but the last few Windows systems I have installed for people I have applied the following small registry 'patch' to them before going online to download the countless amounts of updates:

--- begin nodcom.reg ---

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"EnableDCOM"="N"

--- end nodcom.reg ---

I do agree that you still should patch it, but after the first time of going through an install only to be infected with the worm while downloading the updates was enough to drive a person mad.  This is a very simple workaround for something that IMHO isn't very severe any more.

Rob
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031009/1ddc93ff/attachment.html