Re: [Full-Disclosure] DCOM RPC exploit (dcom.c)

From: Nick FitzGerald (nick_at_virus-l.demon.co.uk)
Date: 07/28/03

  • Next message: democow ....: "[Full-Disclosure] Re: DCOM RPC exploit (dcom.c)" 
    To: "full-disclosure@lists.netsys.com" <full-disclosure@lists.netsys.com>
Date: Mon, 28 Jul 2003 12:33:56 +1200

    Paul Schmehl <pauls@utdallas.edu> wrote:

    <<snip>>
    > It takes a lot more work than that. What do you do about the machines
    > that *do* need DCOM? Ever notice there are students learning
    > programming at a university? It's not like a corporation where you can
    > shove changes down people's throats without planning carefully first.

    Well, I don't know why anybody ever let most of that MS networking
    stuff run over TCP/IP in the first place. True, preventing NT-based
    OSes from binding RPC and other less-desirable stuff to every available
    interface is not easy, but it is getting more do-able. In case you
    haven't looked yet:

       Minimizing Windows network services

       Jean-Baptiste Marchand

       http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html.en

    Now, so long as you didn't scrimp on network infrastructure and build
    important parts around cheap, TCP/IP-only routers, take that
    information and start thinking "what if we put Windows RPC services on
    IPX/SPX?". Still doesn't help you prevent the morons who are allowed
    to install/config their own boxes from "getting it wrong" but gives
    that part of the network that does accept your guidance a fair degree
    of "free" protection while leaving DCOM RPC avalable to those that
    really do "need" it.

    > You have consistently stated that all that needs to be done is "the
    > work". The implication is that there's nothing to it. It can be easily
    > done if folks would just get to work. That implication is false and
    > trivializes the amount of work that has to be done. That is what I'm
    > objecting to.

    I'd also object most strongly that MS still sees fit to decide a priori
    that a _very little used_ service "should be" installed and enabled and
    bound to every firking network interface on every box its OS is
    installed upon. We kept hearing that "least privilege" and "service
    minimization" were the key drivers behind the Windows Server 2003
    security review -- we now know that the drivers were DWI...

    But it gets worse. Instead of being off by default and requiring a
    degree of nouse be applied in the very rare cases where those services
    really are needed, we have something that requires intimate familiarity
    with your hardware and arcane registry tweaking procedures to remove to
    make your machine "well-enough secured". (And what's the bet that the
    interface-by-interface binding of RPC services described in Marchand's
    paper can (silently) "break" if you add, remove or reconfigure network
    adaptors in the machine??)

    Regards,

    Nick FitzGerald

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: democow ....: "[Full-Disclosure] Re: DCOM RPC exploit (dcom.c)"

    Relevant Pages

    • Re: PID 1212 slowly maxing out?
      ... Windows 2003 servers, but could it affect Windows XP as well? ... I'm on a home network running on wireless. ... Logical Disk Manager service ...
      (microsoft.public.windowsxp.help_and_support)
    • RE: Printing from Win9x clients stops
      ... Open Server Management. ... then right-click the name of the computer running Windows Small Business ... >From the client computer: ... The Select Network Component Type ...
      (microsoft.public.windows.server.sbs)
    • Re: Cant print to my Windows 98 shared printer from my XP compute
      ... >>>I can't print from the printer attached to my Windows 98 machine using my XP ... >>>Add Printer wizard and has a pipe attached, indicating a network printer. ... >>>98 machine and I can successfully ping the 98 machine from my XP laptop. ... >>>driver name showed up as UNIDRV.DLL on my XP test page when it last worked. ...
      (microsoft.public.windowsxp.network_web)
    • Re: Slow file copy to network shares Windows 7
      ... The problem is that Windows 7 copys and pastes the ... folder containing folders and files from a network share to a network ... performed to demonstrate that copying the test folder from a network share ... When copied from a network location and pasted back to a network location ...
      (microsoft.public.windows.file_system)
    • Re: Slow file copy to network shares Windows 7
      ... The problem is that Windows 7 copys and pastes the test ... folder containing folders and files from a network share to a network share ... performed to demonstrate that copying the test folder from a network share to ... When copied from a network location and pasted back to a network location ...
      (microsoft.public.windows.file_system)
    • Quantcast