RPC DCOM still vulnerable even after applying patches

From: khan rohail (rohaikaz_at_YAHOO.COM)
Date: 07/28/03

  • Next message: Dave Vantine: "MS03-029 Q823803 RAS services no longer starting"
    Date:         Mon, 28 Jul 2003 08:34:13 -0700
    To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
    
    

    This is in reference to exploit code available here:
    http://www.securiteam.com/exploits/5CP0N0KAKK.html
    .......

    We (Douglas Mclean/and I) have checked it against
    windows 200 SP4 machines that "even if you apply the
    patch kb823980", you can get DOS attacks as tcp port
    135 service (loc-srv)gets crashed and we get this
    error on the box against which the exploit is being
    run:

    "SVCHOST.exe has generated errors and will be closed
    by Windows. You will need to restart the program. An
    error log is being created".

    You are not able to access Event log either and other
    funny things are detected too.

    --------
    So, even if you apply the patch MS03-026 you still are
    vulnerable and you can still get DOS attacks.

    Regards
    Shoaib Qazi/Douglas McClean
    UAB

    __________________________________
    Do you Yahoo!?
    Yahoo! SiteBuilder - Free, easy-to-use web site design software
    http://sitebuilder.yahoo.com

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Are You "Certifiable"? Summer's Hottest Certification Just Got HOTTER!

    With a growth rate exceeding 110%, the TICSA security practitioner
    certification is one of the hottest IT credentials available. And now, for
    a limited time, you can save 33% off of the TICSA certification exam! To
    learn more about the TICSA certification, and to register as a TICSA
    candidate online, just go to

    http://www.trusecure.com/offer/s0100/

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo


  • Next message: Dave Vantine: "MS03-029 Q823803 RAS services no longer starting"

    Relevant Pages

    • Re: MS03-026 - are you patched? Windows Update isnt sure!
      ... Hoping to shed a little light on the file version checking in Windows ... querying the Windows Installer service (which amounts to a metabase or ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)
    • Re: Microsoft Numbering System
      ... Do me a favor and load up a new Windows XP box, ... on each and every patch. ... Summer's Hottest Certification Just Got HOTTER! ... To learn more about the TICSA certification, and to register as a TICSA ...
      (NT-Bugtraq)
    • Re: clients contacting WU directly
      ... set Cryptographic Services to Automatic for Startup ... Install Windows XP SP1 again. ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)
    • Re: Alert: Microsoft Security Bulletin - MS03-039
      ... The way that Microsoft patched the new RPC Part II vulnerability ... Summer's Hottest Certification Just Got HOTTER! ... To learn more about the TICSA certification, ...
      (NT-Bugtraq)
    • Re: clients contacting WU directly
      ... When I deployed the Windows Automatic Update feature across our domain (to ... force clients to accept updates from our local SUS machine) I also ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)