Jump to content
BulForum.com

XP - DoS & remote - be aware!


ov3rm4n

Recommended Posts

Security Community,

 

The following information references a serious security threat to you or

your organization if the proper measures have not been taken to prevent

its destructive intent.

 

Description of Issue

--------------------

VigilantMinds has successfully validated the claims regarding the latest

Microsoft Remote Procedure Call (RPC) vulnerability. Specifically,

VigilantMinds has validated that hosts running fully patched versions of

the following Microsoft operating systems REMAIN subject to denial of

service attacks and possible remote exploitation:

 

* Microsoft Windows XP Professional

* Microsoft Windows XP Home

* Microsoft Windows 2000 Workstation

 

Although it has not been verified at this time, other versions of

Microsoft Windows are also suspected to be subject to this

vulnerability.

 

As with the prior RPC vulnerability (MS03-039), these attacks can occur

on TCP ports 135, 139, 445 and 593; and UDP ports 135, 137, 138 and 445.

 

 

Remediation Actions

-------------------

VigilantMinds has notified CERT/CC and informed the vendor of this

issue. As of this posting, no vendor patch is yet available.

 

As a temporary solution, VigilantMinds suggests that firewall rules be

placed on all affected ports for any exposed systems. All external

connectivity (including VPN) should be firewalled actively for

unnecessary incoming RPC activity.

 

A Snort signature that will detect traffic patterns associated with this

attack is below. Note that current Snort signatures may also identify

this attack.

 

 

Further References

------------------

 

A Snort signature for this and other versions of the Microsoft RPC

vulnerability:

 

alert TCP any any -> any 135 (msg:"RPC Vulnerability - bind

initiation";sid:1; rev:1; content:"|05 00 0B 03 10 00 00 00 48 00 00 00

7F 00 00 00 D0 16 D0 16 00 00 00 00 01 00 00 00 01 00 01 00 a0 01 00 00

00 00 00 00 C0 00 00 00 00 00 00 46 00 00 00 00 04 5D 88 8A EB 1C C9 11

9F E8 08 00 2B10 48 60 02 00 00 00|";

flow:to_server,established;classtype:attempted-admin;)

 

 

 

********************************************

Security Operations Center

VigilantMinds Inc.

 

email: soc rpc vigilantminds com

Office 412-661-5700

Fax 412-661-5684

********************************************

 

This e-mail and any files transmitted with it may contain confidential

and/or proprietary information. Any use, distribution, copying or

disclosure by another person is strictly prohibited. It is intended

solely for the use of the individual or entity who is the intended

recipient. Unauthorized use of this information is prohibited.

 

********************************************

 

 

-----Original Message-----

From: 3APA3A [mailto:3APA3A SECURITY NNOV RU]

Posted At: Friday, October 10, 2003 10:49 AM

Posted To: Full Disclosure

Conversation: [Full-Disclosure] Bad news on RPC DCOM vulnerability

Subject: [Full-Disclosure] Bad news on RPC DCOM vulnerability

 

 

Dear bugtraq securityfocus com,

 

There are few bad news on RPC DCOM vulnerability:

 

1. Universal exploit for MS03-039 exists in-the-wild, PINK FLOYD is

again actual. 2. It was reported by exploit author (and confirmed),

Windows XP SP1 with all security fixes installed still vulnerable to

variant of the same bug. Windows 2000/2003 was not tested. For a while

only DoS exploit exists, but code execution is probably possible.

Technical details are sent to Microsoft, waiting for confirmation.

 

Dear ISPs. Please instruct you customers to use personal fireWALL in

Windows XP.

 

--

Link to comment
Share on other sites

За съжаление, това е само върха на айсберга :wir, но повечето се правят, че не ги засяга.

(имам предвид постнатото от ov3rm4n, а не "изявите" на момчето след това :woot )

Link to comment
Share on other sites

Kato se ima predvid, 4e problema e ot predi SP1... A si stoi i sled SP1... Ako za tova govori6 de...

No tova e polojenieto - funkcionalnost, za smetka na drugi raboti => Microsoft... Interesno mi e sega s kakvo obiasnenie 6te izliazat toia pat... za6to ne e fix-nato v pack-a...

Link to comment
Share on other sites

Kato se ima predvid, 4e problema e ot predi SP1... A si stoi i sled SP1... Ako za tova govori6 de...

No tova e polojenieto - funkcionalnost, za smetka na drugi raboti => Microsoft... Interesno mi e sega s kakvo obiasnenie 6te izliazat toia pat... za6to ne e fix-nato v pack-a...

Ами то даже има и по-лошо, има пачове, които всъщност не оправят нищо - пичовете от eeye ня няколко пъти го показват, ама ония от Редмънт си траят все едно става въпрос не за windoze, а за млеконадоя на кравите в Холандия :woot

Link to comment
Share on other sites

ne6tata naistina sa slojni pri tiah - imat si grafici, goniat srokove... niama da se iznenadam, ako kajat 4e sa polu4ili infoto za toia problem sled kato ve4e e bil gotov za puskane SP1 i za tova ne e bil vkliu4en... ili pak 6te kajat - mi to tova vsa6tnost ne e security risk - slojete si firewall... i tva se e slu4valo...

Link to comment
Share on other sites

Dear  ISPs.  Please  instruct  you customers to use personal fireWALL in Windows XP.

Mi to si go pishe be, horata sa si kazali tochno i iasno kak da se reshi problema. Zashto e nuzno da se vpriagat edi si kolko dushi da reshavat problema i da se poharchat edi si kolko pari (za zaplatite im), kato moze i po-lesnia nachin. :D

Microsoft si e Microsoft boli gi fara za userite :wacko: .

Link to comment
Share on other sites

Mi to si go pishe be, horata sa si kazali tochno i iasno kak da se reshi problema. Zashto e nuzno da se vpriagat edi si kolko dushi da reshavat problema i da se poharchat edi si kolko pari (za zaplatite im), kato moze i po-lesnia nachin. :D

Microsoft si e Microsoft boli gi fara za userite  :wacko: .

E da ama vse pak sa kazali da se izpolzva Firewall taka 4e se za6titavat

Link to comment
Share on other sites

RPM DCOM vulnarability-to veche e fixnato USH s ediniq ot patchovete koito shte sa v SP2 .. neznam de no pone sled kato go fixna Exploit-a ne raboti i WormBlast-a ne raboti nachi ie fixnato a i e normalno RPC da ima exploiti za nego se pak za LINUX za sichki rpc.portmap-ve postoianno puskaha Exploiti edno vreme i za tova veche nikoi ne si go puska ... to nqama nujda ot nego sq loshto e che MS sa zabranili spiraneto mu no mislq che ako reshat moje da go napravqt da se spira nqakak btw vijte si Logovete shtoto as sled kato patchnah XP-to s DCOM patch veche mi dava Warrning`s na DCOM-a che ne raboti ili neshto takova t.e. pusnat e no neraboti mislq che tva e dostatachno reshenie ...... na problema

 

 

btw : kachete sin Win98 we basi :) eventualno nai tupia Firewall s Win98 sha vi naprai jelezni ( pochti ) i nqama kvo da se bezpokoite kvo sedite na XP kat ne vi haresva ?

Link to comment
Share on other sites

btw : kachete  sin Win98 we basi :) eventualno nai tupia Firewall s Win98 sha vi naprai jelezni ( pochti ) i nqama kvo da se bezpokoite kvo sedite na XP kat ne vi haresva ?

Tuk ne stava vapros za heresvane, a za izdunki, koito v interes na istinata Microsoft praviat redovno.

Link to comment
Share on other sites

Izdynkite na M$ vsi4ki znaem che nqmat krai, spro nqma za tova.

Windows XP deistvitelno e po-stabilen ot Win98, napraven e uj i da e po-lesen za upotreba, nali zatova vseki e s nego koito moje :)

Loshoto e che i zatova e dosta otvoren za ataki, sledva otkym sigurnost e nazad za smetka na ulesneni setup proceduri za internet, LAN, ustroistva UPnP i mnogo drugi.

Zatova 4owek prosto triabva da maha vsi4ko naj-obstoino koeto ne mu triabva ot Service-ite, software-a, i estestveno maksimalno zashtita s firewall, zapushvane na vsi4ki (po4ti) lokalni 'slushashti' portove .

Link to comment
Share on other sites

XP e dobra OS, stiga da ne po4ne da ti zabiva. Kato me hvana Blaster-a, baq zor vidqh dokato go opravq, 6 puti si formatirah diska i vse taq, s purvoto vlizane v neta i tyi kato nqmah Firewall, pak mi go lepvaha. Nakraq si install-nah Server 2003, za6toto ne uspqh da se spravq s Blaster-4eto. No si e istina, 4e XP e mnogo po-lesno i stabilno ot 98, no zatova puk kato si s 98, virusite te podminavat kato malka gara. 4ak se 4uvstva6 prenebregnat.

Link to comment
Share on other sites

virusite te podminavat kato malka gara. 4ak se 4uvstva6 prenebregnat.
haha, chicatillo :)

az iskam takova prenebregvane!

Verno che 98 go podminavat virusite, za 95 da ne govorim ili za 3.1, za men obache stabilnostta na XP mi triabva poveche ot drugite neshta na 98.

Za blastera..., ami bez firewall az ne vlizam i za sekunda v neta, i 100 pyti da formatirash diska, dokato port 135 ti e otvoren, 6te go fa6ta6 ( i dokato ima v mrejata na EK otkade da go fa6ta6).

Az imah edna anomalia svarzana s port 1900 i port 5000, no otkakto go razbrah otde ide, si zatvorih vsi4ki lokalni portove, vijte koi mojete da si blokirate i za kakvo sa:

http://www.mdjnet.dk/ports.html

Link to comment
Share on other sites

:D Много ме разсмяхте, вирусите отбягвали win98 :D . Червеи от типа на Blaster (това е червй, а не вирус - разликата е огромна) са около 1%, всичко останало се разпространява по email, изпълним код и т.н. основно в комбинацията win 9x/2000/XP и особено с Outlook клиент :woot. Да се твърди, че win98 е извън "играта" е най-забавната история, кято съм чувал напоследък :D :D :D
Link to comment
Share on other sites

godfather, prav si, obache nie govorim vav vrazka to4no s poslednite sabitiq okolo Blaster-a, koito naposledak zarazi naj-mnogo ot nas. Az lichno ot godini izpolzvam internet i komputri, Blaster-a e pyrvoto koeto hva6tam kato virus (kato kazvam virus imam predvid vsi4ko koeto pravi razni neshta koito az ne jelaia! ), a Blastera e ot okolo 2 meseca i vse oshte samo za nego se govori po forumite.

I naposledak az li4no do4uvam za vse poveche 4ervei i razni takiva troianci,virusi, koito zasqgat Win2000 nagore. Ne 4e win98 ne e zasegnat, povecheto 'virusi' zasqgat vsi4ki win-ove razbira se.

Link to comment
Share on other sites

a we Win98 ne e zasegnat ot nikvi Wormove i ETC.. shtoto ima samo edna SAMBA kato service i nishto drugo .... kvo iskate da go exploitne toi i bez firewall si e jelezen

btw za toq det beshe kazal che e kachil 2003 da si beshe sedial na nego dosta e dobyr

Link to comment
Share on other sites

a we Win98 ne e zasegnat ot nikvi Wormove i ETC.. shtoto ima samo edna SAMBA kato service i nishto drugo ....

SAMBA е продукт с отворен код (www.samba.org), който ОСЪЩЕСТВЯВА някои от услугите на Window$ в *nix среда, които вървят по SMB протокола и няма нищо общо с win98, още по-малко пък като service :P

Link to comment
Share on other sites

... които вървят по SMB протокола ...

...koito e Microsoft protokol. :D :D

 

however - bezmislen spor se zaformia pak. Prosto si slojete firewall i tva e - tova e smisala na parvona4alnia post, ni6to drugo...

 

Procedurnoto predlojenie se priema s leko izmenenie - ne bira s vodka, a bira s tekila... :D

Ostava da uto4nim koga i kade.

 

@JOKe:

 

Vzemi vlez malko v 4as koe kakvo e i kak pupli iz mrejata... Worm e programa, koiato se razprostraniava 4rez e-mail saob6tenia prez e-mail klienta ti (nai-ve4e OE)... Taka 4e tva za Win98 i worms deto ne go ebavali - ne pozna. Ima6li mail klient - ima6 i vrata za worm-a... A za SAMBA deto ia imal Win98 - e tva ve4e neznam kakvo da kaja...

Link to comment
Share on other sites

Prosto si slojete firewall i tva e - tova e smisala na parvona4alnia post, ni6to drugo...

Прав си, но за да се чувстват хората достатъчно сигурни трябва не само да си сложат firewall, но и да забравят за такива "велики" произведения като outlook например :bgrin:

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...