New RPCDCOM Exploit Could be brewing

[Steveswaldo]

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-043.asp

at the moment their is only a dos proof of concept, but i smell soon a exploitable shell version of this. This is gonna hit hard like DCOM did with the blaster worm(s).

* Messages are delivered to the Messenger service via NetBIOS or RPC. If users have blocked the NetBIOS ports (ports 137-139) - and UDP broadcast packets using a firewall, others will not be able to send messages to them on those ports. Most firewalls, including Internet Connection Firewall in Windows XP, block NetBIOS by default.

http://www.k-otik.com/exploits/10.18.MS03-043.c.php

 

[David Lindon]

Thanks for the warning.