 (8.9.1/8.9.1) with ESMTP id LAA28555	for ; Thu, 11 Dec 2003 11:42:29 -0800 (PST) Received: from ucsb.edu (ucsb.edu [128.111.24.40])	by charm.physics.ucsb.edu (8.9.3/8.9.3) with ESMTP id LAA19578	for ; Thu, 11 Dec 2003 11:42:28 -0800 Received: from localhost ([127.0.0.1] helo=hub.ucsb.edu)	by ucsb.edu with esmtp  id 1AUWhf-0003Da-AI; Thu, 11 Dec 2003 11:42:27 -0800 Received: from hub.ucsb.edu ([128.111.24.40] helo=smtp.ucsb.edu)	by ucsb.edu with esmtp TLSv1:AES256-SHA:256 id 1AUWha-0003DJ-1l;	Thu, 11 Dec 2003 11:42:22 -0800 Received: from security3.oit.ucsb.edu ([128.111.12.28] helo=UCSB.edu)	by smtp.ucsb.edu with asmtp TLSv1:AES256-SHA:256 id 1AUWhY-0003DD-3g;	Thu, 11 Dec 2003 11:42:20 -0800 Message-ID: <3FD8C89A.4010207@UCSB.edu> Date: Thu, 11 Dec 2003 11:42:18 -0800 From: E. Todd Atkins  User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US;	rv:1.5) Gecko/20031027 Thunderbird/0.3 X-Accept-Language: en-us, en MIME-Version: 1.0 To: security-microsoft@ucsb.edu, csf@ucsb.edu Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score-ucsb.edu: 0.0 (/) X-Spam-Score-ucsb.edu: 0.0 (/) Subject: [CSF] Blocked (and Vulnerable) Hosts X-BeenThere: csf@ucsb.edu X-Mailman-Version: 2.1.2 Precedence: list Reply-To: UCSB Network Security Coordinator  List-Id: Computer Support Forum   List-Unsubscribe: ,	 List-Archive:  List-Post:  List-Help:  List-Subscribe: ,	 Sender: csf-bounces@ucsb.edu Errors-To: csf-bounces@ucsb.edu X-Spam-Score-ucsb.edu: 0.0 (/) Hello, You can find a "filtered hosts" list as well as a "unpatched hosts"  lists further down in this message.Here is what you need to do if your  host is in the "filtered hosts" list: 1. Make sure that the host has been completely cleaned up. Unless the host is completely rebuilt, please make sure that the host is not running any rogue IRC bots, FTP servers, VNC, etc. Tools like "tcpview" and "procexp" from www.sysinternals.com should help to locate any such services. 2. Send an email message to security@ucsb.edu to inform us that the host is now safe to be connected with the internet. When referring to multiple IP addresses, please list the IP addresses on separate lines. If you are not the NOC's official network contact for the address(es), then be sure to CC that person. If you decide to simply reply to this message, please do *not* include the complete lists of IPs. Please just include the IP(s) that you are writing to us about. 3. If you find any rogue services running, please include the type of service and the port that it was using. Now, here are the lists: *** Filtered Hosts (from  http://noc.ucsb.edu/~shaber/net/ngb/filtered.txt) *** 128.111.20.39   agate.wirelesstest.ucsb.edu 128.111.20.40   dhcp20-40.wirelesstest.ucsb.edu 128.111.29.26   -- 128.111.29.39   -- 128.111.34.65   pfrws-1.engr.ucsb.edu 128.111.34.120  helix.mee.ucsb.edu 128.111.57.44   starbucks.ece.ucsb.edu 128.111.58.215  srpan.ece.ucsb.edu 128.111.68.248  -- 128.111.72.47   dahlehpc-3.mee.ucsb.edu 128.111.72.143  plank.mee.ucsb.edu 128.111.74.85   davidmac.materials.ucsb.edu 128.111.74.249  -- 128.111.77.107  das.crss.ucsb.edu 128.111.82.132  seppia.chemengr.ucsb.edu 128.111.82.133  codavinci.chemengr.ucsb.edu 128.111.82.140  peleg.chemengr.ucsb.edu 128.111.92.216  -- 128.111.103.21  otter.opl.ucsb.edu 128.111.103.24  penguin.opl.ucsb.edu 128.111.103.29  trout.opl.ucsb.edu 128.111.104.131 gdhcp131.geog.ucsb.edu 128.111.104.155 euphrates.geog.ucsb.edu 128.111.106.15  zulu2.geog.ucsb.edu 128.111.108.49  slicks.geol.ucsb.edu 128.111.108.193 host108-193.lsdepts.ucsb.edu 128.111.108.219 host108-219.lsdepts.ucsb.edu 128.111.120.25  ip25.lmri.ucsb.edu 128.111.138.160 -- 128.111.161.6   -- 128.111.164.209 turtle.mee.ucsb.edu 128.111.185.230 ra.ece.ucsb.edu 128.111.199.90  host199-90.lsdepts.ucsb.edu 128.111.220.127 dhcp127.nceas.ucsb.edu 128.111.221.52  dhcp17.mat.ucsb.edu 128.111.225.113 -- 128.111.229.220 -- 128.111.229.229 -- 128.111.234.239 sylvey.geog.ucsb.edu 128.111.247.7   -- 128.111.247.62  -- 128.111.247.63  -- 128.111.247.250 -- *** Unpatched hosts *** 128.111.9.244   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.33.40   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.37.117  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.39.221  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.50.92   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.60.83   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.71.94   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.71.97   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.75.239  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.76.241  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.79.11   RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.106.77  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.108.156 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.164.79  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.180.226 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.204 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.181.207 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.75  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.195 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.212 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.219 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.228 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.182.250 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.32  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.99  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.183.110 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.177 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.223 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.183.236 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.184.137 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.185.7   RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.197.189 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.198.220 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.202.228 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.220.91  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.220.93  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.220.225 RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.234.23  RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.234.160 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] 128.111.242.63  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.249.67  RPCSS Vulnerable - [KB823980 Patched, KB824146 Vulnerable] 128.111.253.133 RPCSS Vulnerable - [KB823980 Vulnerable, KB824146  Vulnerable] *** Statistics *** Filtered Hosts ............................... 43 RPCSS Vulnerable ............................. 42 DCOM Disabled ................................ 57 Not Vulnerable ............................... 2450 Errors ....................................... 7 TCP Port 135 Closed or Host Timeout .......... 62980 TOTAL HOSTS SCANNED .......................... 65536 -- Todd Atkins Network Security Coordinator UCSB/Office of Information Technology Voice: (805) 893-5077 Fax: (805) 893-5051 http://www.oit.ucsb.edu/security _______________________________________________ CSF mailing list  -  CSF@ucsb.edu http://ucsb.edu/mailman/listinfo/csf