 (8.9.1/8.9.1) with ESMTP id PAA14643	for ; Tue, 7 Oct 2003 15:03:38 -0700 (PDT) Received: from ucsb.edu (ucsb.edu [128.111.24.40])	by charm.physics.ucsb.edu (8.9.3/8.9.3) with ESMTP id PAA14319	for ; Tue, 7 Oct 2003 15:03:38 -0700 Received: from localhost ([127.0.0.1] helo=hub.ucsb.edu)	by ucsb.edu with esmtp  id 1A6zve-0007nD-0j; Tue, 07 Oct 2003 15:03:38 -0700 Received: from hub.ucsb.edu ([128.111.24.40] helo=smtp.ucsb.edu)	by ucsb.edu with esmtp TLSv1:AES256-SHA:256 id 1A6zvb-0007n2-1i;	Tue, 07 Oct 2003 15:03:35 -0700 Received: from security3.oit.ucsb.edu ([128.111.12.28])	by smtp.ucsb.edu with asmtp TLSv1:DES-CBC3-SHA:168 id 1A6zva-0007my-S5;	Tue, 07 Oct 2003 15:03:34 -0700 Date: Tue, 07 Oct 2003 15:03:34 -0700 From: E. Todd Atkins  To: security-microsoft@ucsb.edu, csf@ucsb.edu Message-ID: <246540000.1065564214@abc.oit.ucsb.edu> X-Mailer: Mulberry/3.0.3 (Linux/x86) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; FORMAT=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Subject: [CSF] Blocked and RPCSS Vulnerable Hosts X-BeenThere: csf@ucsb.edu X-Mailman-Version: 2.1.2 Precedence: list Reply-To: UCSB Network Security Coordinator  List-Id: Computer Support Forum   List-Unsubscribe: ,	 List-Archive:  List-Post:  List-Help:  List-Subscribe: ,	 Sender: csf-bounces@ucsb.edu Errors-To: csf-bounces@ucsb.edu X-Scanner: exiscan for exim4 (http://duncanthrax.net/exiscan/) *1A6zve-0007nD-0j*Ppqpvt3xBkQ* Hello, These lists are being periodically sent out due to the large number of  hosts that are either compromised or infected with one of the Microsoft  Windows based worms, as well as those that are vulnerable according to a  daily scan which I am conducting. There is also a summary so that we can  all track the progress of reducing UCSB's exposure to this vulnerability. Here is what you need to do if your host is in the list: 1. Make sure that the host has been completely cleaned up. Unless the host  is completely rebuilt, please make sure that the host is not running any  rogue IRC bots, FTP servers, VNC, etc. Tools like "tcpview" and "procexp"  from www.sysinternals.com should help to locate any such services. 2. Send an email message to security@ucsb.edu to inform us that the host is  now safe to be connected with the internet. When referring to multiple IP  addresses, please list the IP addresses on separate lines. If you are not  the NOC's official network contact for the address(es), then be sure to CC  that person. 3. If you find any rogue services running, please include the type of  service and the port that it was using. Now, here are the lists: *** Filtered Hosts *** 128.111.9.230   dhcp230.itp.ucsb.edu 128.111.9.241   dhcp241.itp.ucsb.edu 128.111.19.32   tau.physics.ucsb.edu 128.111.20.208  dhcp20-208.wirelesstest.ucsb.edu 128.111.29.20   meppc1.engr.ucsb.edu 128.111.29.25   meppc6.engr.ucsb.edu 128.111.29.26 128.111.29.39 128.111.29.55   camp.engr.ucsb.edu 128.111.29.157  poseidon.ece.ucsb.edu 128.111.29.159  roscoe2.ece.ucsb.edu 128.111.34.65   pfrws-1.engr.ucsb.edu 128.111.44.150 128.111.56.173  dhcp56-173.ece.ucsb.edu 128.111.57.16   pilon.ece.ucsb.edu 128.111.57.29   vishi.ece.ucsb.edu 128.111.58.215  srpan.ece.ucsb.edu 128.111.68.247 128.111.74.158  nakamuralab8.materials.ucsb.edu 128.111.74.249 128.111.77.36   luna.crss.ucsb.edu 128.111.77.82   theomac.crss.ucsb.edu 128.111.77.107  das.crss.ucsb.edu 128.111.81.36   pulse.ucen.ucsb.edu 128.111.82.13   joshtest.chemengr.ucsb.edu 128.111.82.14   connerjs.chemengr.ucsb.edu 128.111.82.129  calimero.chemengr.ucsb.edu 128.111.82.132  seppia.chemengr.ucsb.edu 128.111.82.133  codavinci.chemengr.ucsb.edu 128.111.82.135  adder.chemengr.ucsb.edu 128.111.82.215  theofan.chemengr.ucsb.edu 128.111.83.43   dh83043.chemengr.ucsb.edu 128.111.83.134  cobra.chemengr.ucsb.edu 128.111.83.137  krait.chemengr.ucsb.edu 128.111.92.216 128.111.96.40   coll02.alexandria.ucsb.edu 128.111.103.21  otter.opl.ucsb.edu 128.111.104.155 euphrates.geog.ucsb.edu 128.111.104.172 keyhole.geog.ucsb.edu 128.111.106.15  zulu2.geog.ucsb.edu 128.111.106.101 olympia.geog.ucsb.edu 128.111.108.49  slicks.geol.ucsb.edu 128.111.108.128 host108-128.lsdepts.ucsb.edu 128.111.108.164 host108-164.lsdepts.ucsb.edu 128.111.108.193 host108-193.lsdepts.ucsb.edu 128.111.108.219 host108-219.lsdepts.ucsb.edu 128.111.110.64  zo.bren.ucsb.edu 128.111.111.82  sacagawea.bren.ucsb.edu 128.111.124.71  isc124-71.isc.ucsb.edu 128.111.138.160 128.111.138.171 128.111.138.174 128.111.164.96  DFXL8421.materials.ucsb.edu 128.111.164.209 turtle.mee.ucsb.edu 128.111.165.27  host165-27.lsdepts.ucsb.edu 128.111.166.152 dhcp152.authnet.ucsb.edu 128.111.206.72 128.111.207.81 128.111.221.26  igertpc.mat.ucsb.edu 128.111.229.220 128.111.234.43  ppp3.ncgia.ucsb.edu 128.111.234.55  erebus.ncgia.ucsb.edu 128.111.234.85  vital5.geog.ucsb.edu 128.111.234.239 sylvey.geog.ucsb.edu 128.111.236.73  dhcp-73.crustal.ucsb.edu 128.111.247.62 128.111.247.63 *** Unpatched hosts *** 128.111.9.211   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.27.26   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.30.117  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.30.148  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.30.149  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.30.150  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.30.151  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.30.152  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.30.153  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.30.189  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.30.190  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.30.191  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.30.216  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.31.95   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.32.15   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.55   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.114  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.150  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.152  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.223  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.32.224  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.33.31   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.33.40   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.33.165  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.34.81   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.34.120  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.34.127  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.36.153  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.36.162  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.36.246  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.36.254  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.37.93   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.37.192  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.37.228  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.37.243  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.37.246  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.38.148  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.38.187  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.38.201  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.38.211  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.38.238  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.38.245  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.111  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.166  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.169  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.171  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.186  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.208  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.212  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.214  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.215  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.216  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.224  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.50.92   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.57.22   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.70.53   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.71.94   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.71.110  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.71.245  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.72.143  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.73.76   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.73.87   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.73.199  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.73.236  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.75.17   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.75.74   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.75.111  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.75.168  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.75.176  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.75.240  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.75.249  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.76.62   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.76.75   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.76.217  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.78.16   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.79.11   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.82.180  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.103.24  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.104.55  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.104.156 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.104.174 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.106.6   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.106.63  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.109.160 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.109.230 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.109.236 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.112.137 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.132.97  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.164.46  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.164.79  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.164.202 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.180.173 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.180.182 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.180.193 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.180.202 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.180.218 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.180.231 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.133 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.140 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.198 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.204 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.205 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.207 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.250 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.75  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.118 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.195 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.198 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.212 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.216 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.218 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.219 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.223 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.226 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.229 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.236 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.184.252 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.185.75  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.192.37  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.193.244 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.193.248 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.195.117 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.196.221 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.197.71  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.197.104 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.198.206 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.205.141 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.219.34  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.220.162 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.226.31  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.226.116 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.227.123 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.234.160 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.247.7   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.247.250 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.248.97  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.249.123 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.249.168 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.249.175 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.249.194 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.249.201 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.253.153 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] *** Statistics *** Filtered Hosts ............................... 67 RPCSS Vulnerable ............................. 142 DCOM Disabled ................................ 68 Not Vulnerable ............................... 3459 Errors ....................................... 11 TCP Port 135 Closed or Host Timeout .......... 61747 TOTAL HOSTS SCANNED .......................... 65428 -- Todd Atkins Network Security Coordinator UCSB/Office of Information Technology Voice: (805) 893-5077 Fax: (805) 893-5051 http://www.oit.ucsb.edu/security _______________________________________________ CSF mailing list  -  CSF@ucsb.edu http://ucsb.edu/mailman/listinfo/csf