is it even possible for a worm with dcom vuln?

From: Victor Pereira <vpereira(at)modulo.com.br>
Date: Tue Jul 29 2003 - 15:33:13 EDT

<H D Moore>

A highly-effective worm would be not be difficult to write for the reasons below. Residential ISP's should start blocking 445 and 135 immediately. Corporate networks should block these ports in both directions at every major gateway as soon as possible.
....
</H D Moore>

Don't forget all wireless lans without access restrictions around the world. It is a good target to start a worm propagation using microsoft services, because a lot of companies close it in they're internet firewalls, but in a LAN enviroment, everything is open.
I can't figure out the damage.. can you ? ;-)

Reguards,

---

Victor Pereira - LPI, CCSA, CCSE

http://www.modulo.com.br
http://getdata.codigolivre.org.br Received on Wed Jul 30 15:44:16 2003