TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
David,
You're right. The -S 2 argument placed at the end of the entry for sadmind in
/etc/inetd.conf addresses a different vulnerability. I didn't mention it since it
isn't related to the sadmind/IIS worm exploit. In my case, I don't use Solstice
Adminsuite to administer my machines, so I keep sadmind commented out in
/etc/inetd.conf which is the safest way to go. (sadmind is an inetd started daemon,
so it doesn't have a startup script but rather, an entry in /etc/inetd.conf that just
needs to be commented out - along with sending a "kill -HUP" signal to the pid of the
inetd daemon.)
- Gary
"Yong, David" wrote:
> Forgive me if I am wrong, but I thought that in order to fully protect yourself from
>this vulnerability you had to add a '-s' in the startup script for sadmind. If you
>just patch the OS, I think the sadmind is still vulnerable. You need to patch it as
>well as update the startup script. Or just remove it altogether :)
>
> -----Original Message-----
> From: Love, Gary [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, June 06, 2001 3:58 PM
> To: Yong, David; [EMAIL PROTECTED]
> Cc: '[EMAIL PROTECTED]'
> Subject: RE: Worm IIS
>
> I have a bug reported to ISS (#376395) for the sadmind buffer overflow check
> in the Internet Scanner product. My testing showed that ISS was reporting
> the vulnerability when in fact the sadmind service had been patched. I
> provided scan logs to their engineers and ISS acknowledged that they knew of
> the bug.
>
> I'd be interested in knowing if the Real Secure sensor is also reporting a
> false positive when the sadmind service is available and patched.
>
> Also, the Internet Scanner check for the IIS Unicode vul (MS00-078) is
> working for us.
>
> Gary
>
> Gary Love
> SAIC Secure Business Solutions Group
> SPAWAR Systems Center, San Diego
> [EMAIL PROTECTED]
>
> -----Original Message-----
> From: Yong, David [mailto:[EMAIL PROTECTED]]
> Sent: Tuesday, June 05, 2001 1:47 PM
> To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
> Subject: RE: Worm IIS
>
> TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
> [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
> problems!
> ----------------------------------------------------------------------------
>
> I know that the sadmind vulnerability is covered, which is how the virus
> spreads, and pretty sure that the IIS vulnerability is already covered.
> That worm is actually just a combination of the two vulnerabilities.
>
> -----Original Message-----
> From: Pedro Fernandez [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, May 31, 2001 7:51 AM
> To: [EMAIL PROTECTED]
> Subject: Worm IIS
>
> TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
> [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
> problems!
> ----------------------------------------------------------------------------
>
> Hi,
>
> Is the CA-2001-11 sadmind/IIS Worm vulnerability advisory covered by the
> last Xpress Update of Real Secure?
> or exists other way who detect!
>
> Thanks
>
> Pedro Fern�ndez A.
> Consultor en Seguridad - ISS Certified
> Orion 2000 S.A.- Servicios Profesionales en Seguridad Inform�tica
> La Concepci�n 322 Piso 12 Providencia
> Santiago, Chile
> Fono : 56-2-6403942, Fax : 56-2-6403990
> mailto:[EMAIL PROTECTED]
> http://www.orion.cl
