[30817] in bugtraq
RE: [LSD] Critical security vulnerability in Microsoft Operating Systems
daemon@ATHENA.MIT.EDU (Russ)
Sat Jul 19 15:16:29 2003
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Date: Fri, 18 Jul 2003 18:35:23 -0400
content-class: urn:content-classes:message
Message-ID: <E9A01F52DC939448BBDE44ED2E1C468F2407FA@muskie.rc.on.ca>
From: "Russ" <Russ.Cooper@rc.on.ca>
To: "Todd Sabin" <tsabin@razor.bindview.com>,
"Last Stage of Delirium" <contact@lsd-pl.net>,
<bugtraq@securityfocus.com>
Content-Transfer-Encoding: 8bit
----
o ncacn_http : if active, listening on TCP port 593.
Finally, if ncacn_http is active, and COM Internet Services is
installed and enabled, which is NOT the default in any configuration
I'm aware of, then you can also talk to the endpoint mapper over port
80. Just to be clear, I think this is a very uncommon scenario, but
the possibility does exist.
----
Microsoft list RPC over HTTP as a mitigator. I checked with them and they've confirmed that it isn't vulnerable. Therefore fear of attacks via TCP 80, or against COM+, are IMO unfounded.
Further, what's the likelihood that a machine will have TCP139 or 445 open and not have TCP135 open too? While its certainly realistic to state attacks could come via named pipes, I personally think its unlikely. Given all of the activity we have on those ports already, none of it using named pipes, I'd think we'd have seen something else use them before now.
Cheers,
Russ - NTBugtraq Editor
