Full Disclosure mailing list archives
RE: RE: DCOM Exploit MS03-026 attack vectors
From: "Parker, Jeff (MSE)" <jeff.t.parker () hp com>
Date: Fri, 1 Aug 2003 08:54:50 -0400
Please do not forget port 593/tcp and 593/udp. If you (or someone else) heard something about the vulnerability working over http (rumored to 80/tcp), port 593 is what you should be aware of. The DCOM vuln is indeed usable over port 593. -----Original Message----- From: Jasper Blackwell [mailto:jasper599 () hotmail com] Sent: Friday, August 01, 2003 1:51 AM To: full-disclosure () lists netsys com Subject: [Full-disclosure] RE: DCOM Exploit MS03-026 attack vectors Hi All,
Microsoft owns up to the exploit being usable on 135, 139 and 445, I
have
heard rumors of port 80 being vulnerable as well. I was curious as to whether anyone had seen anything using a port other than 135?
Everything I
have seen discussed here and elsewhere has been 135 specific. Thanks, Paul Tinsley
I have no more information as yet, expect to say that I saw someone asking a similar question somewhere else and they asked whether the RPC_CONNECT method could be used in HTML to spread this. Now I am not an HTML programmer let alone a C programmer so I have no idea whether that is feasible or not. However I would be very interested if it is as it could make a big difference to all of us. So any of the more knowledgable people out there, is there anyway that comes to mind that this exploit could work over port 80? What about other programs that use DCOM and listen on other ports, are they vulnerable in theory? Would it require entirely new exploitcode for each package/port to be exploited? By the way I am not asking for an exploit, I am neutral in the whole debate, just someone who knows what they are talking about to give us an idea of whether this thing is ever going to work over ports other then 135. Jasp _________________________________________________________________ Hotmail messages direct to your mobile phone http://www.msn.co.uk/msnmobile _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- DCOM Exploit MS03-026 attack vectors Paul Tinsley (Jul 31)
- Re: DCOM Exploit MS03-026 attack vectors Nick FitzGerald (Aug 01)
- <Possible follow-ups>
- RE: DCOM Exploit MS03-026 attack vectors Brad Bemis (Jul 31)
- RE: DCOM Exploit MS03-026 attack vectors Paul Tinsley (Aug 01)
- RE: DCOM Exploit MS03-026 attack vectors Jasper Blackwell (Jul 31)
- Re: RE: DCOM Exploit MS03-026 attack vectors Richard Spiers (Aug 01)
- Re: RE: DCOM Exploit MS03-026 attack vectors Geoincidents (Aug 02)
- Re: RE: DCOM Exploit MS03-026 attack vectors Richard Spiers (Aug 01)
- RE: RE: DCOM Exploit MS03-026 attack vectors Parker, Jeff (MSE) (Aug 01)
- RE: DCOM Exploit MS03-026 attack vectors Bassett, Mark (Aug 01)
- RE: DCOM Exploit MS03-026 attack vectors Bryan K. Watson (Aug 01)
- Re: DCOM Exploit MS03-026 attack vectors Jeremiah Cornelius (Aug 01)
- Re: DCOM Exploit MS03-026 attack vectors Ron DuFresne (Aug 02)
- RE: DCOM Exploit MS03-026 attack vectors Bryan K. Watson (Aug 01)
- RE: DCOM Exploit MS03-026 attack vectors Nick FitzGerald (Aug 02)