RE: [Full-Disclosure] DCOM RPC exploit (dcom.c)

From: Schmehl, Paul L (pauls_at_utdallas.edu)
Date: 07/28/03

  • Next message: Réda Zitouni: "[Full-Disclosure] Cisco Aironet AP 1100 Malformed HTTP Request Crash Vulnerability" 
    To: "Ron DuFresne" <dufresne@winternet.com>
Date: Mon, 28 Jul 2003 11:12:27 -0500

    > -----Original Message-----
    > From: Ron DuFresne [mailto:dufresne@winternet.com]
    > Sent: Monday, July 28, 2003 10:46 AM
    > To: Schmehl, Paul L
    > Cc: Robert Wesley McGrew; full-disclosure@lists.netsys.com
    > Subject: RE: [Full-Disclosure] DCOM RPC exploit (dcom.c)
    >
    > And those sites during slammer that blocked 1434, as was
    > advised when the patch was made available, though it was
    > advised even long before that, were largely unafected. Sites
    > that are properly blocking 135 and it's protocolcs will most
    > likely be unaffected from any new worm wishing to exploit
    > this repeat problem with DCOM/RPC.
    >
    This is simply and plainly false. I don't know why people can't seem to
    grasp this. I know of several major corporations who not only had
    1434/UDP blocked at the firewall but also on a number of internal
    routers *and* had aggressive patching programs, and they *still*
    suffered from Slammer. All it takes is *one* infected box *inside* the
    network to negate all the hard work you've done trying to keep the worm
    out.

    When you have 150,000 machines worldwide, having 1% of those unpatched
    (which is a 99% *success* rate) means you have 1500! vulnerable
    machines. Most situations that I'm familiar with were in the tens - not
    even the hundreds - but it only took 10 or 15 machines to take down the
    entire network due to the nature of that worm. 10 or 15 boxes
    represents 1/100th of a percent of the total, yet that small number
    could completely destablize a network and cause untold hours of work for
    the admins and networking staff.

    Now anybody who wants to tell me that a 0.01% failure rate in a patching
    program proves the admins are incompetent is simply ignorant of the
    issues. I guess it's just impossible for people who don't actually run
    a large network to grasp the nature of the issues.

    You build your little home network, you put up a FreeBSD box as a
    NAT/Router/Firewall, and you think you understand networking in a large
    enterprise? You haven't a clue.

    Paul Schmehl (pauls@utdallas.edu)
    Adjunct Information Security Officer
    The University of Texas at Dallas
    AVIEN Founding Member
    http://www.utdallas.edu/~pauls/
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Réda Zitouni: "[Full-Disclosure] Cisco Aironet AP 1100 Malformed HTTP Request Crash Vulnerability"

    Relevant Pages

    • [Full-Disclosure] RE: RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
      ... > If this is truly the case Paul then you have my sympathy. ... The issue for us was similar to that M. Schmehl describes. ... university, or scientists and engineers at a research institution, are ... to tell them what they may or may not do with the network. ...
      (Full-Disclosure)
    • Re: General
      ... understand the why of the ActiveSync quality issues. ... Paul T. ... We can safely say the ROM upgrade was irrelevant to the problem ... of stuff that interacts with network adapters on your PC. ...
      (microsoft.public.pocketpc.activesync)
    • Re: General
      ... Paul T. ... It sounds to me like there is a problem with the ROM update for your ... of stuff that interacts with network adapters on your PC. ... anti-virus/anti-scripting programs from dozens of vendors, ...
      (microsoft.public.pocketpc.activesync)
    • Re: Dns.GetHostEntry functionality
      ... I maually put in a DNS entry into the device network settings, even though OpenNetCF apis are reporting dns addresses. ... "Paul G. Tobey " <p space tobey no spam AT no instrument no spam DOT ... If you have two PC-type machines, open a MS-DOS window on one of them and try to view the network information for the one whose name you're currently trying to resolve, using the machine name. ...
      (microsoft.public.dotnet.framework.compactframework)
    • Re: [fw-wiz] iso 17799
      ... Supplicant: "Hey! ... Paul: "Yes, he is. ... nobody can do it on a reasonably large network. ... It's the NO song! ...
      (Firewall-Wizards)