TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Forgive me if I am wrong, but I thought that in order to fully protect yourself from
this vulnerability you had to add a '-s' in the startup script for sadmind. If you
just patch the OS, I think the sadmind is still vulnerable. You need to patch it as
well as update the startup script. Or just remove it altogether :)
-----Original Message-----
From: Love, Gary [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, June 06, 2001 3:58 PM
To: Yong, David; [EMAIL PROTECTED]
Cc: '[EMAIL PROTECTED]'
Subject: RE: Worm IIS
I have a bug reported to ISS (#376395) for the sadmind buffer overflow check
in the Internet Scanner product. My testing showed that ISS was reporting
the vulnerability when in fact the sadmind service had been patched. I
provided scan logs to their engineers and ISS acknowledged that they knew of
the bug.
I'd be interested in knowing if the Real Secure sensor is also reporting a
false positive when the sadmind service is available and patched.
Also, the Internet Scanner check for the IIS Unicode vul (MS00-078) is
working for us.
Gary
Gary Love
SAIC Secure Business Solutions Group
SPAWAR Systems Center, San Diego
[EMAIL PROTECTED]
-----Original Message-----
From: Yong, David [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, June 05, 2001 1:47 PM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: RE: Worm IIS
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
I know that the sadmind vulnerability is covered, which is how the virus
spreads, and pretty sure that the IIS vulnerability is already covered.
That worm is actually just a combination of the two vulnerabilities.
-----Original Message-----
From: Pedro Fernandez [mailto:[EMAIL PROTECTED]]
Sent: Thursday, May 31, 2001 7:51 AM
To: [EMAIL PROTECTED]
Subject: Worm IIS
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
Hi,
Is the CA-2001-11 sadmind/IIS Worm vulnerability advisory covered by the
last Xpress Update of Real Secure?
or exists other way who detect!
Thanks
Pedro Fern�ndez A.
Consultor en Seguridad - ISS Certified
Orion 2000 S.A.- Servicios Profesionales en Seguridad Inform�tica
La Concepci�n 322 Piso 12 Providencia
Santiago, Chile
Fono : 56-2-6403942, Fax : 56-2-6403990
mailto:[EMAIL PROTECTED]
http://www.orion.cl
