Re: DCOM RPC exploit (dcom.c)

[Robert Wesley McGrew <rwm8 () CSE MsState EDU>]

Good of a point as any to jump into this, with a couple of questions to
steer conversation towards something resembling productivity ;).  For the
record, I support full-disclosure with "reasonable" vendor notification,
taking into account a time to acknowledge and a time to patch, and I also
support the release of exploit code publicly, especially with some warning
time given such as this situation.  That said, I see the point of people
who bring up the complexities of this, that disagree with me on this, and
for the most part, the arguments are well reasoned.  So I have two
questions, one on exploit code, and one on this in particular:

1) How would you propose to change the scene/industry/community of
security in such a way that would prevent the public release of exploit
code like this?

2) For this DCOM RPC problem in particular, everyone's talking about
worms.  How would the worm know what return address to use?  Remote OS
fingerprinting would mean it would be relatively large, slow, and
unreliable (compared with Slammer), and sticking with one would cause more
machines to just crash than to spread the worm.  I haven't looked into
this very closely yet to see if it can be generalized.

If the above have been answered already, forgive me.  I haven't read
everything in this thread header-to-sig :)

Wesley

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html