RE : DCOM RPC exploit (dcom.c)

["Nicolas Villatte" <Nicolas.Villatte () advalvas be>]

Chris,
It is an old debate between full / partial / non-discolsure. Everybody has
its own point. Personally I prefer to know there is an exploit and to have
it to quickly test/patch (not all patches fixes all exploits).
Public exploit will always be better than private exploit in my opinion.
You can't compare nuclear weapon to an exploit because you usually can
protect yourself from an exploit.

If everybody had nuclear weapon I do not think some countries would have
so much influence in the world politics and economics.
So if I enter your logic,  meaning public exploit=nuclear weapon, I only
see the advantage in keeping it secret to make money about it (sell the
technology to people not having it) and use it as a threat towards the
others (maybe selling security stuff in the pipe to get even richer and
keep exclusivity).

Unfortunately sometimes, there is no difference between keeping it secret
to make a lot of money on it while we still may and security through
obscurity

Cheers.

-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com] On Behalf Of gregh
Sent: Sunday, July 27, 2003 5:09 AM
To: full-disclosure () lists netsys com
Subject: Re: [Full-disclosure] DCOM RPC exploit (dcom.c)



----- Original Message -----
From: Chris Paget <mailto:chrisp () ngssoftware com>
To: Len Rose <mailto:len () netsys com>
Cc: full-disclosure () lists netsys com
Sent: Sunday, July 27, 2003 12:08 PM
Subject: Re: [Full-disclosure] DCOM RPC exploit (dcom.c)


Len,

IMHO there's a difference between "security through obscurity" and posting
working exploit code.  Knowing that there is a vulnerability in DCOM,
accessible over a range of RPC mechanisms (primarily 135/tcp) is all that
most administrators need to know.  It's one thing knowing that you can
kill a person with a gun, and it's another to give away firearms.


Just my $0.02:


Shoot the messenger - that always stops the bad event happening.

Sorry for the sarcasm. I can never see the point in "If we don't tell the
enemy how to build a nuclear weapon they never will so we are safer as a
result" logic.


Greg - you may call me a "Jihad O'Clue." if you wish.

Attachment: smime.p7s
Description: