Vulnerability Development: Re: Open Port on Win98 box

From: <tschweikle_at_FIDUCIA.DE>
Date: Wed, 10 Nov 1999 18:02:03 +0100

>tschweikle_at_FIDUCIA.DE wrote:
>>
>> Hi!
>>
>> We found an open port number 13991 on all Win98 boxes installed. The
>> port is listening on addess 0.0.0.0 (means to all).
>>
>> What software does this port reserve? And what is it listening for?
>>
>
> Not on mine, at least not according to netstat. TCP or UDP? Do you
> have Win98 SE? (I don't.) Is there perhaps some 3rd party application
> that is running on all of your Win98 machines?

There are:
- Notes Client uses port 1352 udp and tcp
- NetFinity uses port 161 udp and tcp

And here is what netstat -a gives me back:

Aktive Verbindungen

  Proto Lokale Adresse Remote-Adresse Status
  TCP datding:1025 DATDING:0 LISTENING
  TCP datding:1614 DATDING:0 LISTENING
  TCP datding:5500 DATDING:0 LISTENING
  TCP datding:loc-srv DATDING:0 LISTENING
  TCP datding:snmp DATDING:0 LISTENING
  TCP datding:1477 DATDING:0 LISTENING
  TCP datding:1533 DATDING:0 LISTENING
  TCP datding:1045 DATDING:0 LISTENING
  TCP datding:1045 junifer:nbsession ESTABLISHED
  TCP datding:1597 DATDING:0 LISTENING
  TCP datding:1597 XCNLM00S:nbsession ESTABLISHED
  TCP datding:1614 nv6002:ssh ESTABLISHED
  TCP datding:1662 DATDING:0 LISTENING
  TCP datding:1662 XCNLM01S:nbsession ESTABLISHED
  TCP datding:1663 DATDING:0 LISTENING
  TCP datding:1663 XCNLM02S:nbsession ESTABLISHED
  TCP datding:nbname DATDING:0 LISTENING
  TCP datding:nbdatagram DATDING:0 LISTENING
  TCP datding:nbsession DATDING:0 LISTENING
  TCP datding:13991 DATDING:0 LISTENING
  TCP datding:1196 DATDING:0 LISTENING
  TCP datding:1196 RM:nbsession ESTABLISHED
  TCP datding:1477 195.200.32.62:1352 ESTABLISHED
  TCP datding:1533 10.2.9.2:1352 CLOSE_WAIT
  TCP datding:1054 DATDING:0 LISTENING
  UDP datding:1025 *:*
  UDP datding:5500 *:*
  UDP datding:snmp *:*
  UDP datding:nbname *:*
  UDP datding:nbdatagram *:*
  UDP datding:13991 *:*

Some of these ports are not used by programms there
supposed to be, ie.: Network Black Jack:1025.

Maybe it woulkd be helpfull to have an application listing
programms reserving ports? If such a beast is arround I would
like to have it (or buy it).

--
Thomas

Received on Nov 13 1999