Threat Level: green Handler on Duty: Russ McRee

SANS ISC: Port 135 Traffic Increase Due To Bobax.C SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Port 135 Traffic Increase Due To Bobax.C
Port 135 Traffic Increase Due To Bobax.C.

A third Bobox variant has been discovered that now uses the RPC/DCOM vulnerability on TCP port 135 in addition to the existing probes on TCP ports 445 and 5000. The DCOM exploit code in Bobax.C contains offsets for both Windows 2000 and Windows XP so Bobax.C can now infect both of these OSes where Bobax.[AB] could only infect Windows XP.


For more details, see http://www.lurhq.com/bobax.html



David Goldsmith

Handler on Duty
David

78 Posts
May 20th 2004

Sign Up for Free or Log In to start participating in the conversation!