Bugtraq mailing list archives
Re: Alert: IE 4.0 Security Zone compromise
From: whacker () PRONTOMAIL COM (Weed Whacker)
Date: Wed, 21 Oct 1998 12:00:36 -0400
About 10 days ago Novell was informed about their tcpip.nlm being vulnerable to the old chargen and echo denial of service attack. I tested and confirmed that Netware 4.11 and 5.0 running tcpip.nlm can be exploited, unless the admin has implemented IP packet filters to prevent servicing these ports (chargen and echo cannot be turned off - IP packets must be filtered). A description of the ancient exploit, along with the code that I downloaded and used for the test, is here: http://www.netcraft.com/presentations/interop/dos.html A Netware admin can implement IP packet filters (directions courtesy a first-rate netware admin): load inetcfg select protocols select tcp/ip enable filtering support exit (and save, of course) load filtcfg select tcp/ip select packet forwarding filters enable it press enter on filters use insert to install each filter (chargen and echo, udp and tcp) exit to the console prompt and type "reinitialize system" Later, Weed Whacker ______________________________________________________________ Get Your Free E-mail and Homepage at http://www.prontomail.com
Current thread:
- Re: Alert: IE 4.0 Security Zone compromise Norbert Luckhardt (Oct 21)
- <Possible follow-ups>
- Re: Alert: IE 4.0 Security Zone compromise Weed Whacker (Oct 21)