Full Disclosure mailing list archives
RE: Foundstone DCOM Scanner
From: "Jerry Heidtke" <jheidtke () fmlh edu>
Date: Thu, 11 Sep 2003 16:39:07 -0500
Except it mistakenly identifies lots of patched systems as still vulnerable. I've tested five different free tools today. Here's a summary of my results: KB824146Scan.exe Microsoft's scanner. Many errors and accuracy problems. Basically unusable. Command line scanner with flexible input and output options, but can't reliably identify Windows 9x systems, systems with DCOM disabled, or some non-standard systems. PTms03039.exe GUI utility from Positive Technologies (http://www.ptsecurity.com). Scans single addresses only, selectable target port. Reliability unknown. RetinaRPCDCOM.exe GUI utility from Retina. Scans up to Class C. Can save output as text or csv file. Very accurate. Currently version 1.10. xfrpcss.exe Command line scanner from ISS. Can scan unlimited addresses, simple usable output. Not very accurate. Identifies many patched systems as still vulnerable. RPCScan2.exe GUI utility from Foundstone. No limits of scan ranges, can read input file. Can save output as text or csv file. Not very accurate. Identifies many patched systems as still vulnerable, especially NT. I'm looking for something that I can scan almost a whole class B, that is a scriptable command line scanner (STDIO) and that is accurate enough to base decisions on about disconnecting unpatched workstations, in order to try to protect some patient care devices that cannot legally be patched but must (for now) remain on our production network. I haven't seen anything yet that meets these simple requirements. Jerry -----Original Message----- From: Jones, David H [mailto:Jones.David.H () principal com] Sent: Thursday, September 11, 2003 2:45 PM To: full-disclosure () lists netsys com Subject: [Full-disclosure] Foundstone DCOM Scanner Foundstone has released version 2 of their free scanning tool. IMHO, this is the best, free tool I've found to scan a class b. http://www.foundstone.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Foundstone DCOM Scanner Jones, David H (Sep 11)
- Re: Foundstone DCOM Scanner Chris Sharp (Sep 11)
- Re: Foundstone DCOM Scanner Jarmo Joensuu (Sep 11)
- <Possible follow-ups>
- RE: Foundstone DCOM Scanner Jerry Heidtke (Sep 11)
- RE: Foundstone DCOM Scanner Marc Soda (Sep 11)
- RE: Foundstone DCOM Scanner Byron Copeland (Sep 11)
- RE: Foundstone DCOM Scanner Marc Maiffret (Sep 12)
- RE: Foundstone DCOM Scanner Marc Soda (Sep 11)
- Re: Foundstone DCOM Scanner Chris Sharp (Sep 11)
- RE: Foundstone DCOM Scanner Jerry Heidtke (Sep 11)
- Re: DCOM MS03-26/MS03-39 Scanners Craig Pratt (Sep 20)