RPC Overflow

[Sirber]

Hi!

I suggest that you pay a visot to Windows Update and download lastest updates. The new discovered bug allow anyone from you LAN or from Internet (if you don't have a router or a firewall) to gain TOTAL access to your computer. I tryed it today at work and it's fully working.

http://windowsupdate.microsoft.com/

[smiller667]

Right. It is just that this "bug" has been well known for like 4 weeks. Kind of funny that people only take note when a worm or a trojan exploits a security hole.

[Sirber]

I knew that hole for some weeks, but the update is now avalible on Windows Update. I just tell people that still don't know about it to upgrade. Is there something wrong with that? :devil:

[ammck55]

For anyone that has all the current updates save this one, here's a link directly to the Blaster Worm patch (http://www.f-secure.com/dl-wxp/). I spent a good deal of the afternoon on the phone talking my Mother through the download and installation of it. She still thinks that if she hits the wrong key at the wrong time, the pc will do a meltdown on the spot. :) Here's another link to an article in the USA Today newspaper detailing steps for the successful eviction of the worm.

http://www.usatoday.com/money/industries/technology/2003-08-13-worm_x.htm

ammck55

[Nic]

It's caused loads of trouble for me at work....grrrr. It's a very vulnerable problem, and the msblast is a very poor addition to the exploit code (dcom.c). We're all lucky that other VXers didn't make a more destructive worm....

-Nic

[smiller667]

Originally posted by Sirber
I just tell people that still don't know about it to upgrade. Is there something wrong with that? :devil: Nothing wrong at all. The tone of my posting was definitely off. I guess I was just getting tired of reading and listeningto it everywhere, forums, newspapers, TV, radio :).

And does it always take MS so long to make their patches available on windowsupdate.com? Afaik, the patch was available for normal downloading July 16.

[Sirber]

:D

We need to spred the infos like a plague, like for me I heard this long ago by a friend over MSN, not on the news/forums/etc.

[auenf]

and if you look at the security page for this, its been updated a couple of days ago cause they found that the patch broke RAS on NT4 servers ;)

Enf...

[Emp3r0r]

Here is some interesting information about exploit... If you have a removable disk set to C: drive like on my WinXP machine, it stops the worm from being able to run the trivial ftp. Its interesting because this little anomaly affects so many poorly writtin programs that assume C: is a hard drive. Even with this oddball configuration, WinXP has held itself together for well over a year now... an impressive feat for a heavily used windows machine.