Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
431
Views
0
Helpful
3
Replies

signature 5858-1, DNS Server RPC Interface Buffer Overflow

mhellman
Level 7
Level 7

‎03-21-2008 08:42 AM - edited ‎03-10-2019 04:02 AM

All the documentation seems to suggest that this overflow occurs on ports >1023. Why do all the subsigs all check 139,445?

http://tools.cisco.com/MySDN/Intelligence/viewThreat.x?threatId=5392

Labels:
0 Helpful
3 Replies 3

mhellman
Level 7
Level 7

‎03-21-2008 09:03 AM

After doing a little more reading, it would appear that an authenticated attack can occur over ports 139,445. An unauthenticated attack can occur over ports >1023. So, is 5858-0 designed to provide coverage for the unauthenticated attack (I can't tell because lots of info is hidden)?

0 Helpful

wsulym
Cisco Employee
Cisco Employee
In response to mhellman

‎03-21-2008 10:12 AM

Yes, you would be correct.

0 Helpful

mhellman
Level 7
Level 7
In response to wsulym

‎03-21-2008 10:14 AM

thanks.

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card