Scarpozzi
Lifer
Security Community,
The following information references a serious security threat to you or
your organization if the proper measures have not been taken to prevent
its destructive intent.
Description of Issue
--------------------
VigilantMinds has successfully validated the claims regarding the latest
Microsoft Remote Procedure Call (RPC) vulnerability. Specifically,
VigilantMinds has validated that hosts running fully patched versions of
the following Microsoft operating systems REMAIN subject to denial of
service attacks and possible remote exploitation:
* Microsoft Windows XP Professional
* Microsoft Windows XP Home
* Microsoft Windows 2000 Workstation
Although it has not been verified at this time, other versions of
Microsoft Windows are also suspected to be subject to this
vulnerability.
As with the prior RPC vulnerability (MS03-039), these attacks can occur
on TCP ports 135, 139, 445 and 593; and UDP ports 135, 137, 138 and 445.
Remediation Actions
-------------------
VigilantMinds has notified CERT/CC and informed the vendor of this
issue. As of this posting, no vendor patch is yet available.
As a temporary solution, VigilantMinds suggests that firewall rules be
placed on all affected ports for any exposed systems. All external
connectivity (including VPN) should be firewalled actively for
unnecessary incoming RPC activity.
A Snort signature that will detect traffic patterns associated with this
attack is below. Note that current Snort signatures may also identify
this attack.
The following information references a serious security threat to you or
your organization if the proper measures have not been taken to prevent
its destructive intent.
Description of Issue
--------------------
VigilantMinds has successfully validated the claims regarding the latest
Microsoft Remote Procedure Call (RPC) vulnerability. Specifically,
VigilantMinds has validated that hosts running fully patched versions of
the following Microsoft operating systems REMAIN subject to denial of
service attacks and possible remote exploitation:
* Microsoft Windows XP Professional
* Microsoft Windows XP Home
* Microsoft Windows 2000 Workstation
Although it has not been verified at this time, other versions of
Microsoft Windows are also suspected to be subject to this
vulnerability.
As with the prior RPC vulnerability (MS03-039), these attacks can occur
on TCP ports 135, 139, 445 and 593; and UDP ports 135, 137, 138 and 445.
Remediation Actions
-------------------
VigilantMinds has notified CERT/CC and informed the vendor of this
issue. As of this posting, no vendor patch is yet available.
As a temporary solution, VigilantMinds suggests that firewall rules be
placed on all affected ports for any exposed systems. All external
connectivity (including VPN) should be firewalled actively for
unnecessary incoming RPC activity.
A Snort signature that will detect traffic patterns associated with this
attack is below. Note that current Snort signatures may also identify
this attack.
