Re: [CERT] Why alerts on ports 1025-1029, 1036

those ports are use as RPC endpoints for COM/COM+ under windows 2000/XP i beleive, which would explain why ZoneAlarm would try to block those.

>From what i understand, COM(+) binding starts at 1024 and quickly use more
ports (up to 5000). There are a couple articles in the MS knowledge base about this (support.ms.com/search/default.aspx and search for 1025 port connection)

I believe that some application like ZoneAlarm will block specific applications from binding/using some network interfaces unless you specifically allow for those.

I hope this answers your concerns...

i suggests you check out the various tools to see what applications are binding to those ports (if those are rogue services or something else harmless)

Good Luck..

ePAc.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

On Tue, 1 Apr 2003, Tomas Carlsson wrote:

> Date: Tue, 1 Apr 2003 00:04:23 +0200
> From: Tomas Carlsson <xtc@skildra.nu>
> To: incidents@securityfocus.com
> Subject: [CERT] Why alerts on ports 1025-1029, 1036
>
> I get constant alerts from Zonealarm and it is always blocking on

---
Nothing is foolproof to a sufficiently talented fool...
  oo
,(..)\
  ~~

----------------------------------------------------------------------------
Powerful Anti-Spam Management and More...
SurfControl E-mail Filter puts the brakes on spam,
viruses and malicious code. Safeguard your business
critical communications. Download a free 30-day trial:
http://www.securityfocus.com/SurfControl-incidents