Full Disclosure mailing list archives
Re: No one else seeing the new MS05-039 worm yet?
From: "Morning Wood" <se_cur_ity () hotmail com>
Date: Tue, 30 Aug 2005 07:16:43 -0700
does is listen on port5000 to? 2 attempts we seen come from machines nmap'd below - wonder if its what you talking about - we think they being used as proxy to jump from
port 5000 is open on only XP w/pnp enabled, however this helps identify XP from 2k and allows a good guess as to which OS is running. ( for proper targeting ) cheers, mw _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- No one else seeing the new MS05-039 worm yet? Vic Vandal (Aug 29)
- Re: No one else seeing the new MS05-039 worm yet? Morning Wood (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? Vic Vandal (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? Something Anonymous (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? Morning Wood (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? Willem Koenings (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? fd (Aug 30)
- <Possible follow-ups>
- Re: No one else seeing the new MS05-039 worm yet? Peter Ferrie (Aug 30)
- Re: No one else seeing the new MS05-039 worm yet? Morning Wood (Aug 30)