RE: DCOM RPC exploit

["Steve W. Manzuik" <steve () entrenchtech com>]

Hi Chris.

Funny you post this from your NGS Software account.  Does Saphire/Slapper
ring a bell?  Isn't this a bit of the pot calling the kettle black?

Do you really think for one second that HD Moore, Benjurry, and FlashSky are
the only people capable of coming up with exploit code for this?  The day it
was announced I saw two other exploits that haven't been publically
announced.  The community of people who have the skills to write such a worm
already had the exploit code, or at the very minimum enough information to
replicate it the day this was released.

A worm exploiting this might happen, but is it really that big of a deal?

> Message: 13
> Date: Sat, 26 Jul 2003 20:16:24 -0400 (Eastern Daylight Time)
> From: Chris Paget <chrisp () ngssoftware com>
> To: "full-disclosure () lists netsys com" 
> <full-disclosure () lists netsys com>
> Subject: Re: [Full-disclosure] DCOM RPC exploit  (dcom.c)
>
>
> <sarcasm>
>
> I'd just like to thank FlashSky, Benjurry, and H D Moore for 
> releasing this
> code.  Really guys, sterling job.  Now the skript kiddies and 
> VXers have got
> virtually no work to do in order to write a worm that exploits this.
>
> </sarcasm>
>
> Personally, I'm tempted to set up my firewall to NAT incoming 
> requests on port
> 135 to either www.metasploit.com or www.xfocus.org.  I know 
> this is the
> full-disclosure list, but working exploit code for an issue 
> this huge is taking
> it a bit far, especially less than 2 weeks after the advisory 
> comes out.
>
> Cheers, fellas.  When the worm comes out, I'll be thinking of you.
>
> Chris


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html