RE: DCOM RPC exploit (dcom.c)

[Ron DuFresne <dufresne () winternet com>]

        [SNIP]

> What fingerprinting?  If you've got 135/UDP open to the Internet, you're
> screwed.  Slammer didn't fingerprint.  It simply hit every box it could
> find on port 1434/UDP, and the exploit either worked or it didn't.  Most
> worms do the same.  They attack indiscriminately, and infect those Oses
> that are susceptible.  And with Windows, that's enough boxes to cause a
> real problem.

And those sites during slammer that blocked 1434, as was advised when the
patch was made available, though it was advised even long before that,
were largely unafected.  Sites that are properly blocking 135 and it's
protocolcs will most likely be unaffected from any new worm wishing to
exploit this repeat problem with DCOM/RPC.

Thanks,


Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
        ***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html