RE: RPC over HTTP security

["Depp, Dennis M." <deppdm () ornl gov>]

No it is not equivalent.  RPC over HTTP requires authentication prior to
allowing RPC traffic.  However, if a mobile user was infected with a
worm that utilized RPC as an attack vector, then this traffic could be
allowed into your network. (After the affected user was authenticated.)
Of course the same is true for VPN technologies as well.

Dennis

-----Original Message-----
From: sf_mail_sbm () yahoo com [mailto:sf_mail_sbm () yahoo com] 
Sent: Friday, January 28, 2005 5:37 AM
To: security-basics () securityfocus com
Subject: Re: RPC over HTTP security

In-Reply-To: <921115752CD94C48BF2F2B8A46AFC1B30398D8@mail3.vdc2.local>

Thanks to all who responded

Just a few remarks:

Referring to the 'tons of links on http://www.microsoft.com/security&apos;,
not all the tons of link are related to RPC over HTTP

What I really wanted to know is 'How secure is RPC over HTTP
TECHNOLOGY'?

Is this setup similar to allowing RPC access through port 80 and 443
INSTEAD OF 135, 445... ?

If this is the case, then vulnerabilities like the RPC DCOM could well
be exploited... and what of future vulnerabilities...

So is RPC over HTTP equivalent as if we are opening ports 139, 445 to
the server?

thanks all