MESSAGE
DATE | 2003-03-30 |
FROM | vin
|
SUBJECT | Subject: [hangout] Microsoft RPC hole could lead to DoS attacks Can we fix this with shared source?
|
http://www.theinquirer.net/?article=8576
Microsoft RPC hole could lead to DoS attacks
Reach for the patches unless you use NT
By Arron Rouse: Thursday 27 March 2003, 19:39 REMOTE PROCEDURE CALL (RPC) hacks seem to be flavour of the month. Only a week ago a major vulnerability was found in the Sun XPR RPC. Now one has been found in Windows 2000, XP and NT. The hole doesn't allow an attacker to gain control but it would effectively stop the machine working.
Microsoft has released patches for Windows 2000 and XP. Windows NT users aren't so lucky. Microsoft claims that NT's architecture makes a patch for this impossible. The company says that blocking port 135 at your firewall will stop attackers from being able to use the exploit.
That does leave a large question of what to do with NT servers which are actively executing RPCs. From the looks of the information on the Microsoft site, the only safe option would be to move to 2000 or XP.
It does seem faintly suspicious that Microsoft is doing all it can to get NT users to upgrade to a more recent operating system and that holes are appearing that can't be patched in NT. Then again, maybe NT really is getting too old for some fixes. ยต
____________________________ NYLXS: New Yorker Free Software Users Scene Fair Use - because it's either fair use or useless.... NYLXS is a trademark of NYLXS, Inc
|
|