 (8.9.1/8.9.1) with ESMTP id NAA20853	for ; Mon, 10 Nov 2003 13:26:08 -0800 (PST) Received: from ucsb.edu (hub.ucsb.edu [128.111.24.40])	by charm.physics.ucsb.edu (8.9.3/8.9.3) with ESMTP id NAA01415	for ; Mon, 10 Nov 2003 13:26:08 -0800 Received: from localhost ([127.0.0.1] helo=hub.ucsb.edu)	by ucsb.edu with esmtp  id 1AJJXy-0009ev-Pn; Mon, 10 Nov 2003 13:26:06 -0800 Received: from hub.ucsb.edu ([128.111.24.40] helo=smtp.ucsb.edu)	by ucsb.edu with esmtp TLSv1:AES256-SHA:256 id 1AJJXe-0009eN-Ex;	Mon, 10 Nov 2003 13:25:46 -0800 Received: from security3.oit.ucsb.edu ([128.111.12.28] helo=UCSB.edu)	by smtp.ucsb.edu with asmtp TLSv1:AES256-SHA:256 id 1AJJXZ-0009eI-W3;	Mon, 10 Nov 2003 13:25:42 -0800 Message-ID: <3FB00253.4070007@UCSB.edu> Date: Mon, 10 Nov 2003 13:25:39 -0800 From: E. Todd Atkins  User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US;	rv:1.5) Gecko/20031027 Thunderbird/0.3 X-Accept-Language: en-us, en MIME-Version: 1.0 To: security-microsoft@ucsb.edu, csf@ucsb.edu Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score-ucsb.edu: 0.0 (/) X-Spam-Score-ucsb.edu: 0.0 (/) Subject: [CSF] Blocked Hosts (and those that may be blocked soon) X-BeenThere: csf@ucsb.edu X-Mailman-Version: 2.1.2 Precedence: list Reply-To: UCSB Network Security Coordinator  List-Id: Computer Support Forum   List-Unsubscribe: ,	 List-Archive:  List-Post:  List-Help:  List-Subscribe: ,	 Sender: csf-bounces@ucsb.edu Errors-To: csf-bounces@ucsb.edu X-Spam-Score-ucsb.edu: 0.0 (/) Hello, You can find a "blocked hosts" list as well as a "unpatched hosts" lists further down in this message. Hosts that have been on the "unpatched  hosts" list for more than one week may be blocked in order to prevent  their involvement in any new security incidents. We felt compelled to do  this because patches for these vulnerabilities have been available for  quite some time, hosts in our domain are being scanned for these  vulnerabilities by potential intruders, and system compromises have  occurred due to lack of patching. Here is what you need to do if your host is in the "blocked hosts" list: 1. Make sure that the host has been completely cleaned up. Unless the host is completely rebuilt, please make sure that the host is not running any rogue IRC bots, FTP servers, VNC, etc. Tools like "tcpview" and "procexp" from www.sysinternals.com should help to locate any such services. 2. Send an email message to security@ucsb.edu to inform us that the host is now safe to be connected with the internet. When referring to multiple IP addresses, please list the IP addresses on separate lines. If you are not the NOC's official network contact for the address(es), then be sure to CC that person. If you decide to simply reply to this message, please do *not* include the complete lists of IPs. Please just include the IP(s) that you are writing to us about. 3. If you find any rogue services running, please include the type of service and the port that it was using. Now, here are the lists: *** Filtered Hosts (from  http://noc.ucsb.edu/~shaber/net/ngb/filtered.txt) ***128.111.9.206   -- 128.111.20.52   dhcp20-52.wirelesstest.ucsb.edu 128.111.20.58   dhcp20-58.wirelesstest.ucsb.edu 128.111.29.20   meppc1.engr.ucsb.edu 128.111.29.25   meppc6.engr.ucsb.edu 128.111.29.26   -- 128.111.29.39   -- 128.111.34.65   pfrws-1.engr.ucsb.edu 128.111.34.120  helix.mee.ucsb.edu 128.111.56.235  zuki.ece.ucsb.edu 128.111.57.44   starbucks.ece.ucsb.edu 128.111.58.215  srpan.ece.ucsb.edu 128.111.68.179  -- 128.111.68.248  -- 128.111.72.47   dahlehpc-3.mee.ucsb.edu 128.111.72.143  plank.mee.ucsb.edu 128.111.74.85   davidmac.materials.ucsb.edu 128.111.74.249  -- 128.111.77.107  das.crss.ucsb.edu 128.111.81.36   pulse.ucen.ucsb.edu 128.111.82.132  seppia.chemengr.ucsb.edu 128.111.82.133  codavinci.chemengr.ucsb.edu 128.111.82.140  peleg.chemengr.ucsb.edu 128.111.92.216  -- 128.111.103.21  otter.opl.ucsb.edu 128.111.103.24  penguin.opl.ucsb.edu 128.111.103.29  trout.opl.ucsb.edu 128.111.104.131 gdhcp131.geog.ucsb.edu 128.111.104.155 euphrates.geog.ucsb.edu 128.111.104.172 keyhole.geog.ucsb.edu 128.111.106.15  zulu2.geog.ucsb.edu 128.111.108.49  slicks.geol.ucsb.edu 128.111.108.193 host108-193.lsdepts.ucsb.edu 128.111.108.219 host108-219.lsdepts.ucsb.edu 128.111.120.25  ip25.lmri.ucsb.edu 128.111.138.160 -- 128.111.159.150 -- 128.111.161.6   -- 128.111.164.202 snake.mee.ucsb.edu 128.111.164.209 turtle.mee.ucsb.edu 128.111.219.200 host219-200.lsdepts.ucsb.edu 128.111.229.220 -- 128.111.229.229 -- 128.111.234.239 sylvey.geog.ucsb.edu 128.111.247.7   -- 128.111.247.62  -- 128.111.247.63  -- 128.111.247.250 -- *** Unpatched hosts *** 128.111.30.97   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.32.79   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.251  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.33.40   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.38.245  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.186  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.224  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.238  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.50.201  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.71.94   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.71.97   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.72.33   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.73.246  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.75.127  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.75.238  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.76.49   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.76.198  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.164.79  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.166.143 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.166.148 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.180.179 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.93  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.181.131 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.140 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.204 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.118 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.212 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.216 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.219 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.250 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.84  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.223 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.229 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.236 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.184.99  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.192.37  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.196.202 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.197.5   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.198.206 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.202.228 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.202.241 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.220.82  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.220.136 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.234.23  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.241.109 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.248.97  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.248.173 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.249.67  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] *** Statistics *** Filtered Hosts ............................... 48 RPCSS Vulnerable ............................. 48 DCOM Disabled ................................ 68 Not Vulnerable ............................... 3675 Errors ....................................... 8 TCP Port 135 Closed or Host Timeout .......... 61736 TOTAL HOSTS SCANNED .......................... 65536 -- Todd Atkins Network Security Coordinator UCSB/Office of Information Technology Voice: (805) 893-5077 Fax: (805) 893-5051 http://www.oit.ucsb.edu/security _______________________________________________ CSF mailing list  -  CSF@ucsb.edu http://ucsb.edu/mailman/listinfo/csf