[4027] in WWW Security List Archive
Re: FW: NT4 bug? Or bug in my hardware?
daemon@ATHENA.MIT.EDU (Tony)
Tue Jan 21 22:59:11 1997
Date: Tue, 21 Jan 1997 18:59:04 +0500
To: "Jason T. Luttgens" <luttgenj@kic.or.jp>
From: Tony <tony@ibt.net>
Cc: webserver-nt@DELTA.PROCESS.COM, www-security@ns2.rutgers.edu
Errors-To: owner-www-security@ns2.rutgers.edu
Jason,
This does not seem to be a hardware-related problem. I have reproduced
it on an NT Workstation (4.0 SP2). Port 135 is not in the well-known
services list (%SYSTEMROOT%\drivers\etc\SERVICES), but appears to affect
the Remote Procedure Call Service (RPCSS.EXE). Since this is a special
service it cannot be stopped through the Services applet in the Control
Panel or by using the "net stop" command. The connection appears to be
stuck in the CLOSE_WAIT state and will finally terminate after about 25
minutes. This is definitely a problem that MS needs to address ASAP. I
will relay any additional information that I can gather about this problem.
Please do not use the WWW Security list for followups.
Best Regards,
Tony Weasler
_____________________________________________________________________
Tony Weasler tony@ibt.net http://tony.ibt.net/
"You are the final measure of anything you accomplish."
At 06:27 AM 1/22/97 +0900, you wrote:
>Can anyone confirm this? On an NT4 server (maybe workstation too, I
>don't have it to try), if you telnet to port 135, type a bunch of junk
>(say 10-20 characters), hit enter and disconnect, the server's
>processor utilization will go up to 100%!!! The only fix I found was to
>reboot. I tried with and without SP2.....same result. The installation
>is 'out of the box' with standard default install options, of course
>including TCP/IP. I have no other NT4 servers to try this on and was
>wondering if I could get someone to try and confirm this .....
>
>Luck
>
>
