OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
RPC DCOM still vulnerable even after applying patches

From: khan rohail (rohaikazYAHOO.COM)
Date: Mon Jul 28 2003 - 10:34:13 CDT

This is in reference to exploit code available here:
http://www.securiteam.com/exploits/5CP0N0KAKK.html
.......

We (Douglas Mclean/and I) have checked it against
windows 200 SP4 machines that "even if you apply the
patch kb823980", you can get DOS attacks as tcp port
135 service (loc-srv)gets crashed and we get this
error on the box against which the exploit is being
run:

"SVCHOST.exe has generated errors and will be closed
by Windows. You will need to restart the program. An
error log is being created".

You are not able to access Event log either and other
funny things are detected too.

--------
So, even if you apply the patch MS03-026 you still are
vulnerable and you can still get DOS attacks.

Regards
Shoaib Qazi/Douglas McClean
UAB

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Are You "Certifiable"? Summer's Hottest Certification Just Got HOTTER!

With a growth rate exceeding 110%, the TICSA security practitioner
certification is one of the hottest IT credentials available. And now, for
a limited time, you can save 33% off of the TICSA certification exam! To
learn more about the TICSA certification, and to register as a TICSA
candidate online, just go to

http://www.trusecure.com/offer/s0100/

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo