Re: Snort RPC Vulnerability

Yes, though the risk would be mitigated by the fact that your machine couldn't transmit any data onto the wire; although an attacker wouldn't be able to get an interactive shell of any sort on your machine, they would still be able to rm -rf / the box (or equivalent).

According to the ISS advisory, successful exploitation can occur outside of an established TCP session; stateless TCP segments with the ACK bit set (or possibly even a SYN segment with data) can trigger the vulnerability.

Regards,

J.

On Mon, Mar 03, 2003 at 02:03:25PM -0500, netsecurity wrote:
> If you are using a receive only cable does this still represent a

-- 
Jason V. Miller, Threat Analyst
Symantec, Inc. - www.symantec.com
E-Mail:	jmiller@securityfocus.com

-----------------------------------------------------------
Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.
http://www.securityfocus.com/stillsecure"> 
http://www.securityfocus.com/stillsecure