 (8.9.1/8.9.1) with ESMTP id JAA16038	for ; Wed, 1 Oct 2003 09:45:36 -0700 (PDT) Received: from ucsb.edu (hub.ucsb.edu [128.111.24.40])	by charm.physics.ucsb.edu (8.9.3/8.9.3) with ESMTP id JAA07493	for ; Wed, 1 Oct 2003 09:45:36 -0700 Received: from localhost ([127.0.0.1] helo=hub.ucsb.edu)	by ucsb.edu with esmtp  id 1A4k6a-0007M3-Fk; Wed, 01 Oct 2003 09:45:36 -0700 Received: from hub.ucsb.edu ([128.111.24.40] helo=smtp.ucsb.edu)	by ucsb.edu with esmtp TLSv1:AES256-SHA:256 id 1A4k6X-0007Lo-Gc;	Wed, 01 Oct 2003 09:45:33 -0700 Received: from security3.oit.ucsb.edu ([128.111.12.28])	by smtp.ucsb.edu with asmtp TLSv1:DES-CBC3-SHA:168 id 1A4k6X-0007Lg-Bb;	Wed, 01 Oct 2003 09:45:33 -0700 Date: Wed, 01 Oct 2003 09:45:28 -0700 From: E. Todd Atkins  To: security-microsoft@ucsb.edu, csf@ucsb.edu Message-ID: <44690000.1065026728@abc.oit.ucsb.edu> X-Mailer: Mulberry/3.0.3 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; FORMAT=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Subject: [CSF] Blocked and RPCSS Vulnerable Hosts X-BeenThere: csf@ucsb.edu X-Mailman-Version: 2.1.2 Precedence: list Reply-To: UCSB Network Security Coordinator  List-Id: Computer Support Forum   List-Unsubscribe: ,	 List-Archive:  List-Post:  List-Help:  List-Subscribe: ,	 Sender: csf-bounces@ucsb.edu Errors-To: csf-bounces@ucsb.edu X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *1A4k6a-0007M3-Fk*bGWxVh40kVs* Hello, These lists are being periodically sent out due to the large number of  hosts that are either compromised or infected with one of the Microsoft  Windows based worms, as well as those that are vulnerable according to a  daily scan which I am conducting. There is also a summary so that we can  all track the progress of reducing UCSB's exposure to this vulnerability. Here is what you need to do if your host is in the list: 1. Make sure that the host has been completely cleaned up. Unless the host  is completely rebuilt, please make sure that the host is not running any  rogue IRC bots, FTP servers, VNC, etc. Tools like "tcpview" and "procexp"  from www.sysinternals.com should help to locate any such services. 2. Send an email message to security@ucsb.edu to inform us that the host is  now safe to be connected with the internet. When referring to multiple IP  addresses, please list the IP addresses on separate lines. If you are not  the NOC's official network contact for the address(es), then be sure to CC  that person. 3. If you find any rogue services running, please include the type of  service and the port that it was using. Now, here are the lists: *** Filtered Hosts *** 128.111.9.125   orb125.itp.ucsb.edu 128.111.9.126   orb126.itp.ucsb.edu 128.111.9.210 128.111.9.211   dhcp211.itp.ucsb.edu 128.111.9.230   dhcp230.itp.ucsb.edu 128.111.9.241   dhcp241.itp.ucsb.edu 128.111.20.61   dhcp20-61.wirelesstest.ucsb.edu 128.111.29.20   meppc1.engr.ucsb.edu 128.111.29.25   meppc6.engr.ucsb.edu 128.111.29.26 128.111.29.39 128.111.29.55   camp.engr.ucsb.edu 128.111.29.157  poseidon.ece.ucsb.edu 128.111.29.159  roscoe2.ece.ucsb.edu 128.111.34.65   pfrws-1.engr.ucsb.edu 128.111.44.150 128.111.57.16   pilon.ece.ucsb.edu 128.111.58.215  srpan.ece.ucsb.edu 128.111.68.250 128.111.69.54   ilab-04.cs.ucsb.edu 128.111.74.158  nakamuralab8.materials.ucsb.edu 128.111.74.249 128.111.77.36   luna.crss.ucsb.edu 128.111.77.82   theomac.crss.ucsb.edu 128.111.77.107  das.crss.ucsb.edu 128.111.79.35   sediment.mee.ucsb.edu 128.111.81.36   pulse.ucen.ucsb.edu 128.111.82.13   joshtest.chemengr.ucsb.edu 128.111.82.14   connerjs.chemengr.ucsb.edu 128.111.82.129  calimero.chemengr.ucsb.edu 128.111.82.132  seppia.chemengr.ucsb.edu 128.111.82.133  codavinci.chemengr.ucsb.edu 128.111.82.135  adder.chemengr.ucsb.edu 128.111.82.215  theofan.chemengr.ucsb.edu 128.111.83.43   dh83043.chemengr.ucsb.edu 128.111.83.134  cobra.chemengr.ucsb.edu 128.111.83.137  krait.chemengr.ucsb.edu 128.111.92.216 128.111.96.40   coll02.alexandria.ucsb.edu 128.111.103.21  otter.opl.ucsb.edu 128.111.104.155 euphrates.geog.ucsb.edu 128.111.106.15  zulu2.geog.ucsb.edu 128.111.106.101 olympia.geog.ucsb.edu 128.111.106.163 alexlaptop.geog.ucsb.edu 128.111.108.49  slicks.geol.ucsb.edu 128.111.108.128 host108-128.lsdepts.ucsb.edu 128.111.108.164 host108-164.lsdepts.ucsb.edu 128.111.108.193 host108-193.lsdepts.ucsb.edu 128.111.108.219 host108-219.lsdepts.ucsb.edu 128.111.120.25  ip25.lmri.ucsb.edu 128.111.138.160 128.111.138.171 128.111.138.174 128.111.164.209 turtle.mee.ucsb.edu 128.111.164.224 stefan.materials.ucsb.edu 128.111.164.227 stefandesktop.materials.ucsb.edu 128.111.166.152 dhcp152.authnet.ucsb.edu 128.111.192.21  moblue.ece.ucsb.edu 128.111.207.81 128.111.220.84  dhcp84.nceas.ucsb.edu 128.111.221.26  igertpc.mat.ucsb.edu 128.111.234.43  ppp3.ncgia.ucsb.edu 128.111.234.239 sylvey.geog.ucsb.edu 128.111.236.73  dhcp-73.crustal.ucsb.edu 128.111.247.62 128.111.247.63 *** Unpatched hosts *** 128.111.29.125  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.30.117  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.30.151  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.30.152  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.40   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.55   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.114  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.150  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.33.165  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.34.81   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.34.127  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.35.100  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.36.153  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.36.162  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.36.171  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.37.93   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.37.228  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.37.234  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.37.243  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.38.201  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.38.211  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.38.238  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.111  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.165  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.214  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.50.92   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.57.22   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.68.236  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.70.252  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.71.94   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.71.110  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.71.136  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.71.245  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.73.245  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.73.246  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.75.162  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.75.240  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.75.249  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.76.166  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.76.217  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.78.16   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.79.11   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.82.146  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.82.180  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.87.54   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.92.202  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.104.83  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.106.6   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.106.63  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.106.146 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.108.65  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.108.131 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.109.160 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.109.230 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.132.97  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.132.100 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.145.11  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.161.252 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.164.202 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.180.215 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.180.244 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.204 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.205 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.235 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.61  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.118 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.212 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.216 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.219 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.250 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.223 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.236 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.185.75  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.192.37  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.197.220 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.198.206 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.220.162 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.225.84  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.234.23  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.234.160 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.234.172 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.234.179 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.247.7   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.247.250 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.248.97  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.249.168 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.249.201 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.249.240 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.253.144 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] *** Statistics *** Filtered Hosts ............................... 66 RPCSS Vulnerable ............................. 89 DCOM Disabled ................................ 68 Not Vulnerable ............................... 2416 Errors ....................................... 31 TCP Port 135 Closed or Host Timeout .......... 62932 TOTAL HOSTS SCANNED .......................... 65536 -- Todd Atkins Network Security Coordinator UCSB/Office of Information Technology Voice: (805) 893-5077 Fax: (805) 893-5051 http://www.oit.ucsb.edu/security _______________________________________________ CSF mailing list  -  CSF@ucsb.edu http://ucsb.edu/mailman/listinfo/csf