---- o ncacn_http : if active, listening on TCP port 593. Finally, if ncacn_http is active, and COM Internet Services is installed and enabled, which is NOT the default in any configuration I'm aware of, then you can also talk to the endpoint mapper over port 80. Just to be clear, I think this is a very uncommon scenario, but the possibility does exist. ----
Microsoft list RPC over HTTP as a mitigator. I checked with them and they've confirmed that it isn't vulnerable. Therefore fear of attacks via TCP 80, or against COM+, are IMO unfounded. Further, what's the likelihood that a machine will have TCP139 or 445 open and not have TCP135 open too? While its certainly realistic to state attacks could come via named pipes, I personally think its unlikely. Given all of the activity we have on those ports already, none of it using named pipes, I'd think we'd have seen something else use them before now. Cheers, Russ - NTBugtraq Editor
