Full Disclosure mailing list archives
Re: RE: DCOM Exploit MS03-026 attack vectors
From: "Richard Spiers" <dksaarth () unix za net>
Date: Fri, 1 Aug 2003 09:14:15 +0200
Hey hey guys. I believe it has something to do with CIS. " COM Internet Services Proxy (a feature that is part of Windows 2000 that allows a server to accept DCOM requests tunneled over HTTP)" " The list of supported transports is as follows: Local RPC ncalrpc TCP/IP ncacn_ip_tcp SPX ncacn_spx Named pipes ncacn_np NetBIOS netbios VINES IP ncacn_vns_spp It is not, however, documented in any of Microsoft resources, that Outlook can use another RPC transport, ncacn_http" Its not enabled by default, however in therory this makes whatever port the server is configured to run it on vulnerable. Hope someone else can clear this up further. ----- Original Message ----- From: "Jasper Blackwell" <jasper599 () hotmail com> To: <full-disclosure () lists netsys com> Sent: Friday, August 01, 2003 7:50 AM Subject: [Full-disclosure] RE: DCOM Exploit MS03-026 attack vectors
Hi All,Microsoft owns up to the exploit being usable on 135, 139 and 445, I have heard rumors of port 80 being vulnerable as well. I was curious as to whether anyone had seen anything using a port other than 135? Everything
I
have seen discussed here and elsewhere has been 135 specific. Thanks, Paul TinsleyI have no more information as yet, expect to say that I saw someone asking
a
similar question somewhere else and they asked whether the RPC_CONNECT method could be used in HTML to spread this. Now I am not an HTML
programmer
let alone a C programmer so I have no idea whether that is feasible or
not.
However I would be very interested if it is as it could make a big difference to all of us. So any of the more knowledgable people out there, is there anyway that comes to mind that this exploit could work over port 80? What about other programs that use DCOM and listen on other ports, are they vulnerable in theory? Would it require entirely new exploitcode for each package/port to be exploited? By the way I am not asking for an exploit, I am neutral in the whole
debate,
just someone who knows what they are talking about to give us an idea of whether this thing is ever going to work over ports other then 135. Jasp _________________________________________________________________ Hotmail messages direct to your mobile phone
http://www.msn.co.uk/msnmobile
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- DCOM Exploit MS03-026 attack vectors Paul Tinsley (Jul 31)
- Re: DCOM Exploit MS03-026 attack vectors Nick FitzGerald (Aug 01)
- <Possible follow-ups>
- RE: DCOM Exploit MS03-026 attack vectors Brad Bemis (Jul 31)
- RE: DCOM Exploit MS03-026 attack vectors Paul Tinsley (Aug 01)
- RE: DCOM Exploit MS03-026 attack vectors Jasper Blackwell (Jul 31)
- Re: RE: DCOM Exploit MS03-026 attack vectors Richard Spiers (Aug 01)
- Re: RE: DCOM Exploit MS03-026 attack vectors Geoincidents (Aug 02)
- Re: RE: DCOM Exploit MS03-026 attack vectors Richard Spiers (Aug 01)
- RE: RE: DCOM Exploit MS03-026 attack vectors Parker, Jeff (MSE) (Aug 01)
- RE: DCOM Exploit MS03-026 attack vectors Bassett, Mark (Aug 01)
- RE: DCOM Exploit MS03-026 attack vectors Bryan K. Watson (Aug 01)
- Re: DCOM Exploit MS03-026 attack vectors Jeremiah Cornelius (Aug 01)
- Re: DCOM Exploit MS03-026 attack vectors Ron DuFresne (Aug 02)
- RE: DCOM Exploit MS03-026 attack vectors Bryan K. Watson (Aug 01)
- RE: DCOM Exploit MS03-026 attack vectors Nick FitzGerald (Aug 02)