New RPC Hole in Windows

manadren_it · Post by **manadren_it** » Wed Sep 10, 2003 10:24 pm

Security Bulliten
Knowledgebase Article

Yet another hole in the Remote Procedure Call like the one exploited by the Blaster Worm. Hurry up and get patched before some other moron decides to launch a worm.

Archived topic from Iceteks, old topic ID:1309, old post ID:11518

Red Squirrel · Post by **Red Squirrel** » Wed Sep 10, 2003 10:28 pm

Man, this is horrible! I don't know how Microsoft does it? They need to revise ALL their code completly. There's too many security problems!

Archived topic from Iceteks, old topic ID:1309, old post ID:11520

Wren · Post by **Wren** » Wed Sep 10, 2003 10:29 pm

Thanks, I got patched today.

What would happen if I just disabled RPC in services? Is that only used if you are networking pcs?

Archived topic from Iceteks, old topic ID:1309, old post ID:11521

manadren_it · Post by **manadren_it** » Wed Sep 10, 2003 10:37 pm

Nope, you can't disable RPC.. it may seem like it's only needed for networking PCs, but for some reason it's critical to normal operation.

Archived topic from Iceteks, old topic ID:1309, old post ID:11523

Wren · Post by **Wren** » Wed Sep 10, 2003 10:40 pm

Ok, thanks.

Archived topic from Iceteks, old topic ID:1309, old post ID:11524

manadren_it · Post by **manadren_it** » Wed Sep 10, 2003 10:53 pm

ok, technically you could disable RPC, windows won't really stop you, but expect things to go splat upon doing so. I wouldn't recommend it

Archived topic from Iceteks, old topic ID:1309, old post ID:11527

Wren · Post by **Wren** » Wed Sep 10, 2003 11:02 pm

I did disable it to see what would happen. Guess I didn't leave it off long enough for the splat!

Archived topic from Iceteks, old topic ID:1309, old post ID:11529

Chris Vogel · Post by **Chris Vogel** » Wed Sep 10, 2003 11:11 pm

Thanks for the heads-up! I will have to do that first thing tomorrow!

Archived topic from Iceteks, old topic ID:1309, old post ID:11533

Wren · Post by **Wren** » Wed Sep 10, 2003 11:35 pm

It's not a big file tak, if you want to do it tonight.

Archived topic from Iceteks, old topic ID:1309, old post ID:11541

Triple6_wild · Post by **Triple6_wild** » Thu Sep 11, 2003 1:20 am

as if windows doesnt suck enuff lmao i will grab that b4 i go to bed lol

Archived topic from Iceteks, old topic ID:1309, old post ID:11546

Red Squirrel · Post by **Red Squirrel** » Thu Sep 11, 2003 9:26 am

Wren wrote: I did disable it to see what would happen. Guess I didn't leave it off long enough for the splat!

Windows can be funny. If you do something that can screw it up, it will always wait till you least expect it.

What does RPC do anything? Is it designed *for* viruses to communicate?

That's all I know about that it can do lol.

Archived topic from Iceteks, old topic ID:1309, old post ID:11548

Wren · Post by **Wren** » Thu Sep 11, 2003 12:44 pm

I was curious as the fix for the Blaster worm said you had to disable RPC in order to get the fix, since the worm was causing the pc to reboot every two minutes. I never read anything about why you needed to turn it back on.

Archived topic from Iceteks, old topic ID:1309, old post ID:11557

rovingcowboy · Post by **rovingcowboy** » Fri Sep 12, 2003 4:52 pm

really the trouble is the dcom and you can shut that off. there is a program though for you to check the computer connection go to

http://grc.com/default.htm

and use the shields up to check your computer and then get the dcombobulator program and use it to see if your system is open for attack from that route then you can turn it off if you want to. it is only used for controling app's on your computer from remote or some such thing like that.

that program will tell you what it is for.

good luck. my computer is in 100% stealth mode.

Archived topic from Iceteks, old topic ID:1309, old post ID:11585

Wren · Post by **Wren** » Fri Sep 12, 2003 9:36 pm

I read about that the other day, I think it uses port 135.

I'm patched and stealthed! Good thing too since my ZA has been very busy for the last few weeks!

Archived topic from Iceteks, old topic ID:1309, old post ID:11593