RE: Command Line RPC vulnerability scanner?

On Sat, 2003-08-02 at 10:54, Chris wrote:

> Scanms returns wrong answer when you disabled DCOM on the target box.

I have noticed the same, not just for the ISS scanner but also for the eeye scanner and Nessus. My guess it that the scanners are a bit simple minded and are not checking that dcom is running before sending a probe. When they don't get the correct response to the probe they simply assume it is vulnerable.

I've notified IIS, Eeye and Nessus about the problem.

-- 
Russell Fulton, Network Security Officer, The University of Auckland,
New Zealand.


---------------------------------------------------------------------------
----------------------------------------------------------------------------