ov3rm4n Posted October 11, 2003 Share Posted October 11, 2003 Security Community, The following information references a serious security threat to you or your organization if the proper measures have not been taken to prevent its destructive intent. Description of Issue -------------------- VigilantMinds has successfully validated the claims regarding the latest Microsoft Remote Procedure Call (RPC) vulnerability. Specifically, VigilantMinds has validated that hosts running fully patched versions of the following Microsoft operating systems REMAIN subject to denial of service attacks and possible remote exploitation: * Microsoft Windows XP Professional * Microsoft Windows XP Home * Microsoft Windows 2000 Workstation Although it has not been verified at this time, other versions of Microsoft Windows are also suspected to be subject to this vulnerability. As with the prior RPC vulnerability (MS03-039), these attacks can occur on TCP ports 135, 139, 445 and 593; and UDP ports 135, 137, 138 and 445. Remediation Actions ------------------- VigilantMinds has notified CERT/CC and informed the vendor of this issue. As of this posting, no vendor patch is yet available. As a temporary solution, VigilantMinds suggests that firewall rules be placed on all affected ports for any exposed systems. All external connectivity (including VPN) should be firewalled actively for unnecessary incoming RPC activity. A Snort signature that will detect traffic patterns associated with this attack is below. Note that current Snort signatures may also identify this attack. Further References ------------------ A Snort signature for this and other versions of the Microsoft RPC vulnerability: alert TCP any any -> any 135 (msg:"RPC Vulnerability - bind initiation";sid:1; rev:1; content:"|05 00 0B 03 10 00 00 00 48 00 00 00 7F 00 00 00 D0 16 D0 16 00 00 00 00 01 00 00 00 01 00 01 00 a0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00 46 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B10 48 60 02 00 00 00|"; flow:to_server,established;classtype:attempted-admin;) ******************************************** Security Operations Center VigilantMinds Inc. email: soc rpc vigilantminds com Office 412-661-5700 Fax 412-661-5684 ******************************************** This e-mail and any files transmitted with it may contain confidential and/or proprietary information. Any use, distribution, copying or disclosure by another person is strictly prohibited. It is intended solely for the use of the individual or entity who is the intended recipient. Unauthorized use of this information is prohibited. ******************************************** -----Original Message----- From: 3APA3A [mailto:3APA3A SECURITY NNOV RU] Posted At: Friday, October 10, 2003 10:49 AM Posted To: Full Disclosure Conversation: [Full-Disclosure] Bad news on RPC DCOM vulnerability Subject: [Full-Disclosure] Bad news on RPC DCOM vulnerability Dear bugtraq securityfocus com, There are few bad news on RPC DCOM vulnerability: 1. Universal exploit for MS03-039 exists in-the-wild, PINK FLOYD is again actual. 2. It was reported by exploit author (and confirmed), Windows XP SP1 with all security fixes installed still vulnerable to variant of the same bug. Windows 2000/2003 was not tested. For a while only DoS exploit exists, but code execution is probably possible. Technical details are sent to Microsoft, waiting for confirmation. Dear ISPs. Please instruct you customers to use personal fireWALL in Windows XP. -- Link to comment Share on other sites More sharing options...
HAKERA® Posted October 11, 2003 Share Posted October 11, 2003 Xubav tutorial. Samo ako moje6 da mi kaje6 nay - osnovnoto na bulgarski, za6toto ne mislq, 4e vseki bi mogul da go razbere (puk i az ne sum siguren, 4e razbrax vsi4ko ). Link to comment Share on other sites More sharing options...
ov3rm4n Posted October 11, 2003 Author Share Posted October 11, 2003 Kakav tutorial te goni be?! E ti mi e* mamata... Link to comment Share on other sites More sharing options...
HAKERA® Posted October 11, 2003 Share Posted October 11, 2003 Moje li vse pak da poprevede6 nay - osnovnoto Link to comment Share on other sites More sharing options...
ov3rm4n Posted October 11, 2003 Author Share Posted October 11, 2003 Ne. U4i ezici. Aman ot tip4eta s nick kato tvoia deto se izjiviavat kato razbira4i... 4estno - radvam se, 4e ne ti e iasno kakvo pi6e. Link to comment Share on other sites More sharing options...
Godfather Posted October 11, 2003 Share Posted October 11, 2003 За съжаление, това е само върха на айсберга , но повечето се правят, че не ги засяга. (имам предвид постнатото от ov3rm4n, а не "изявите" на момчето след това ) Link to comment Share on other sites More sharing options...
ov3rm4n Posted October 11, 2003 Author Share Posted October 11, 2003 Kato se ima predvid, 4e problema e ot predi SP1... A si stoi i sled SP1... Ako za tova govori6 de... No tova e polojenieto - funkcionalnost, za smetka na drugi raboti => Microsoft... Interesno mi e sega s kakvo obiasnenie 6te izliazat toia pat... za6to ne e fix-nato v pack-a... Link to comment Share on other sites More sharing options...
Godfather Posted October 11, 2003 Share Posted October 11, 2003 Kato se ima predvid, 4e problema e ot predi SP1... A si stoi i sled SP1... Ako za tova govori6 de...No tova e polojenieto - funkcionalnost, za smetka na drugi raboti => Microsoft... Interesno mi e sega s kakvo obiasnenie 6te izliazat toia pat... za6to ne e fix-nato v pack-a... Ами то даже има и по-лошо, има пачове, които всъщност не оправят нищо - пичовете от eeye ня няколко пъти го показват, ама ония от Редмънт си траят все едно става въпрос не за windoze, а за млеконадоя на кравите в Холандия Link to comment Share on other sites More sharing options...
ov3rm4n Posted October 11, 2003 Author Share Posted October 11, 2003 ne6tata naistina sa slojni pri tiah - imat si grafici, goniat srokove... niama da se iznenadam, ako kajat 4e sa polu4ili infoto za toia problem sled kato ve4e e bil gotov za puskane SP1 i za tova ne e bil vkliu4en... ili pak 6te kajat - mi to tova vsa6tnost ne e security risk - slojete si firewall... i tva se e slu4valo... Link to comment Share on other sites More sharing options...
fon_tomov Posted October 11, 2003 Share Posted October 11, 2003 Dear ISPs. Please instruct you customers to use personal fireWALL in Windows XP. Mi to si go pishe be, horata sa si kazali tochno i iasno kak da se reshi problema. Zashto e nuzno da se vpriagat edi si kolko dushi da reshavat problema i da se poharchat edi si kolko pari (za zaplatite im), kato moze i po-lesnia nachin. Microsoft si e Microsoft boli gi fara za userite . Link to comment Share on other sites More sharing options...
nassko Posted October 12, 2003 Share Posted October 12, 2003 Mi to si go pishe be, horata sa si kazali tochno i iasno kak da se reshi problema. Zashto e nuzno da se vpriagat edi si kolko dushi da reshavat problema i da se poharchat edi si kolko pari (za zaplatite im), kato moze i po-lesnia nachin. Microsoft si e Microsoft boli gi fara za userite . E da ama vse pak sa kazali da se izpolzva Firewall taka 4e se za6titavat Link to comment Share on other sites More sharing options...
JOKe Posted October 12, 2003 Share Posted October 12, 2003 RPM DCOM vulnarability-to veche e fixnato USH s ediniq ot patchovete koito shte sa v SP2 .. neznam de no pone sled kato go fixna Exploit-a ne raboti i WormBlast-a ne raboti nachi ie fixnato a i e normalno RPC da ima exploiti za nego se pak za LINUX za sichki rpc.portmap-ve postoianno puskaha Exploiti edno vreme i za tova veche nikoi ne si go puska ... to nqama nujda ot nego sq loshto e che MS sa zabranili spiraneto mu no mislq che ako reshat moje da go napravqt da se spira nqakak btw vijte si Logovete shtoto as sled kato patchnah XP-to s DCOM patch veche mi dava Warrning`s na DCOM-a che ne raboti ili neshto takova t.e. pusnat e no neraboti mislq che tva e dostatachno reshenie ...... na problema btw : kachete sin Win98 we basi eventualno nai tupia Firewall s Win98 sha vi naprai jelezni ( pochti ) i nqama kvo da se bezpokoite kvo sedite na XP kat ne vi haresva ? Link to comment Share on other sites More sharing options...
fon_tomov Posted October 12, 2003 Share Posted October 12, 2003 btw : kachete sin Win98 we basi eventualno nai tupia Firewall s Win98 sha vi naprai jelezni ( pochti ) i nqama kvo da se bezpokoite kvo sedite na XP kat ne vi haresva ? Tuk ne stava vapros za heresvane, a za izdunki, koito v interes na istinata Microsoft praviat redovno. Link to comment Share on other sites More sharing options...
tedy Posted October 12, 2003 Share Posted October 12, 2003 Izdynkite na M$ vsi4ki znaem che nqmat krai, spro nqma za tova. Windows XP deistvitelno e po-stabilen ot Win98, napraven e uj i da e po-lesen za upotreba, nali zatova vseki e s nego koito moje Loshoto e che i zatova e dosta otvoren za ataki, sledva otkym sigurnost e nazad za smetka na ulesneni setup proceduri za internet, LAN, ustroistva UPnP i mnogo drugi. Zatova 4owek prosto triabva da maha vsi4ko naj-obstoino koeto ne mu triabva ot Service-ite, software-a, i estestveno maksimalno zashtita s firewall, zapushvane na vsi4ki (po4ti) lokalni 'slushashti' portove . Link to comment Share on other sites More sharing options...
Godfather Posted October 12, 2003 Share Posted October 12, 2003 Е, все пак тези магарии на M$ си имат и добра страна - предлагат доста хляб за специалистите по сигурност Link to comment Share on other sites More sharing options...
chicatillo Posted October 12, 2003 Share Posted October 12, 2003 XP e dobra OS, stiga da ne po4ne da ti zabiva. Kato me hvana Blaster-a, baq zor vidqh dokato go opravq, 6 puti si formatirah diska i vse taq, s purvoto vlizane v neta i tyi kato nqmah Firewall, pak mi go lepvaha. Nakraq si install-nah Server 2003, za6toto ne uspqh da se spravq s Blaster-4eto. No si e istina, 4e XP e mnogo po-lesno i stabilno ot 98, no zatova puk kato si s 98, virusite te podminavat kato malka gara. 4ak se 4uvstva6 prenebregnat. Link to comment Share on other sites More sharing options...
tedy Posted October 12, 2003 Share Posted October 12, 2003 virusite te podminavat kato malka gara. 4ak se 4uvstva6 prenebregnat.haha, chicatillo az iskam takova prenebregvane! Verno che 98 go podminavat virusite, za 95 da ne govorim ili za 3.1, za men obache stabilnostta na XP mi triabva poveche ot drugite neshta na 98. Za blastera..., ami bez firewall az ne vlizam i za sekunda v neta, i 100 pyti da formatirash diska, dokato port 135 ti e otvoren, 6te go fa6ta6 ( i dokato ima v mrejata na EK otkade da go fa6ta6). Az imah edna anomalia svarzana s port 1900 i port 5000, no otkakto go razbrah otde ide, si zatvorih vsi4ki lokalni portove, vijte koi mojete da si blokirate i za kakvo sa: http://www.mdjnet.dk/ports.html Link to comment Share on other sites More sharing options...
Godfather Posted October 12, 2003 Share Posted October 12, 2003 Много ме разсмяхте, вирусите отбягвали win98 . Червеи от типа на Blaster (това е червй, а не вирус - разликата е огромна) са около 1%, всичко останало се разпространява по email, изпълним код и т.н. основно в комбинацията win 9x/2000/XP и особено с Outlook клиент . Да се твърди, че win98 е извън "играта" е най-забавната история, кято съм чувал напоследък Link to comment Share on other sites More sharing options...
tedy Posted October 12, 2003 Share Posted October 12, 2003 godfather, prav si, obache nie govorim vav vrazka to4no s poslednite sabitiq okolo Blaster-a, koito naposledak zarazi naj-mnogo ot nas. Az lichno ot godini izpolzvam internet i komputri, Blaster-a e pyrvoto koeto hva6tam kato virus (kato kazvam virus imam predvid vsi4ko koeto pravi razni neshta koito az ne jelaia! ), a Blastera e ot okolo 2 meseca i vse oshte samo za nego se govori po forumite. I naposledak az li4no do4uvam za vse poveche 4ervei i razni takiva troianci,virusi, koito zasqgat Win2000 nagore. Ne 4e win98 ne e zasegnat, povecheto 'virusi' zasqgat vsi4ki win-ove razbira se. Link to comment Share on other sites More sharing options...
JOKe Posted October 12, 2003 Share Posted October 12, 2003 a we Win98 ne e zasegnat ot nikvi Wormove i ETC.. shtoto ima samo edna SAMBA kato service i nishto drugo .... kvo iskate da go exploitne toi i bez firewall si e jelezen btw za toq det beshe kazal che e kachil 2003 da si beshe sedial na nego dosta e dobyr Link to comment Share on other sites More sharing options...
fon_tomov Posted October 12, 2003 Share Posted October 12, 2003 ...shtoto ima samo edna SAMBA... I sin ekran ima... Link to comment Share on other sites More sharing options...
Godfather Posted October 12, 2003 Share Posted October 12, 2003 a we Win98 ne e zasegnat ot nikvi Wormove i ETC.. shtoto ima samo edna SAMBA kato service i nishto drugo .... SAMBA е продукт с отворен код (www.samba.org), който ОСЪЩЕСТВЯВА някои от услугите на Window$ в *nix среда, които вървят по SMB протокола и няма нищо общо с win98, още по-малко пък като service Link to comment Share on other sites More sharing options...
ov3rm4n Posted October 14, 2003 Author Share Posted October 14, 2003 ... които вървят по SMB протокола ... ...koito e Microsoft protokol. however - bezmislen spor se zaformia pak. Prosto si slojete firewall i tva e - tova e smisala na parvona4alnia post, ni6to drugo... Procedurnoto predlojenie se priema s leko izmenenie - ne bira s vodka, a bira s tekila... Ostava da uto4nim koga i kade. @JOKe: Vzemi vlez malko v 4as koe kakvo e i kak pupli iz mrejata... Worm e programa, koiato se razprostraniava 4rez e-mail saob6tenia prez e-mail klienta ti (nai-ve4e OE)... Taka 4e tva za Win98 i worms deto ne go ebavali - ne pozna. Ima6li mail klient - ima6 i vrata za worm-a... A za SAMBA deto ia imal Win98 - e tva ve4e neznam kakvo da kaja... Link to comment Share on other sites More sharing options...
Godfather Posted October 15, 2003 Share Posted October 15, 2003 Prosto si slojete firewall i tva e - tova e smisala na parvona4alnia post, ni6to drugo... Прав си, но за да се чувстват хората достатъчно сигурни трябва не само да си сложат firewall, но и да забравят за такива "велики" произведения като outlook например Link to comment Share on other sites More sharing options...
HAKERA® Posted October 21, 2003 Share Posted October 21, 2003 Kakuv vi e problema be xora? Vzimate si Norton Antivirus, a za po-predpazlivite i Norton Internet Security ot Warez-a i nqmate nikakvi problemi . Za6titata vi e podsigurena . Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.