RE: [Full-Disclosure] MS03-039 has been released - critical

From: Anthony Aykut (anthony.aykut_at_frame4.com)
Date: 09/10/03

  • Next message: Georgi Guninski: "Re: [Full-Disclosure] Bill Gates blames the victim" 
    To: "Robert Ahnemann" <rahnemann@affinity-mortgage.com>, <full-disclosure@lists.netsys.com>
Date: Wed, 10 Sep 2003 22:31:12 +0200

    MS03-026 patched against 1 buffer overflow.
    MS03-039 patches against 3 new buffer overflows.

    That means there are 4 problems in all. All 4 problems occur via DCOM over
    RPC. All 4 problems could be attacked in a similar fashion. All 4 problems
    (as they are likely to occur in an Internet-wide attack) can be thwarted by
    disabling DCOM. 2 of the 3 new problems can be turned into worms.

    If you applied MS03-026, you can still be attacked via the 3 problems
    patched by MS03-039.

    MS03-039 corrects all 4 known DCOM/RPC problems (that's what they mean when
    they say it "supercedes" MS03-026.)

    If you haven't patched, and are going to patch, patch with MS03-039.

    Anthony

    -----Original Message-----
    From: full-disclosure-admin@lists.netsys.com
    [mailto:full-disclosure-admin@lists.netsys.com]On Behalf Of Robert
    Ahnemann
    Sent: Wednesday, September 10, 2003 20:31
    To: full-disclosure@lists.netsys.com
    Subject: RE: [Full-Disclosure] MS03-039 has been released - critical

    I ran the test program (as linked by MS) to see if the network showed as
    patched. I haven't patched any of the machines with the 039 code, but
    all are patched with the 026 one (original one as of July 16th) Does
    this exploit still work (as in leave a vuln) if we have patched 026?
    Might be a dumb question, but I bet other people are thinking it too.

    -----Original Message-----
    From: Exibar [mailto:exibar@thelair.com]
    Sent: Wednesday, September 10, 2003 12:42 PM
    To: full-disclosure@lists.netsys.com
    Subject: Re: [Full-Disclosure] MS03-039 has been released - critical

    anyone know of a 'sploit for this one yet? Or even proof of concept
    code?

    ----- Original Message -----
    From: "Ryan, Pete" <pete.ryan@thomson.com>
    To: <full-disclosure@lists.netsys.com>
    Sent: Wednesday, September 10, 2003 12:23 PM
    Subject: [Full-Disclosure] MS03-039 has been released - critical

    >
    >
    http://www.microsoft.com/technet/treeview/default.asp?url=/technet/secur
    ity/
    > bulletin/MS03-039.asp
    >
    > -Pete
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Georgi Guninski: "Re: [Full-Disclosure] Bill Gates blames the victim"

    Relevant Pages

    • Re: WHY OH WHY?
      ... The need for emergency patches should be an> infrequent occurence. ... > Those who defend MS's lack of ever doing buffer overflow checking at time of> writing code amaze me. ... >> Microsoft Product Deactivation Team ...
      (microsoft.public.security)
    • Re: telnet/ftp problem
      ... >>sounds like a buffer overflow to me, DOH!, are the patches for telnet up ...
      (comp.sys.hp.hpux)
    • RE: [Full-Disclosure] Calcuating Loss
      ... patches out on less critical systems first. ... >> How about when Micro$oft releases a bundled patch ... >> loss. ...
      (Full-Disclosure)
    • Re: [Full-disclosure] Microsoft issues out-of-band patch
      ... Here's an article explaining why Microsoft delays their patching: ... "In order to reduce the costs related to the deployment of patches, ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
      (Full-Disclosure)
    • Re: DCOM access try after connecting the internet
      ... It could be that you're missing one or more RPC / DCOM patches used ... by Blaster / Welchia / Nachi worms. ...
      (microsoft.public.security)
    Loading