How effective is a firewall against RPC exploits?

How effective are firewalls against RPC exploits that use port 135? Specifically the vulnerabilities discussed in M$ security bulletins MS03-026 and MS03-039. I will patch the systems behind the firewalls at a later date (I usually allow some time to let Redmond work the bugs out and do a bunch of patches at the same time) and I want to know if I am safe or not. If I am safe I see no reason to take the risk of loading potentially problematic patches and billing out the clients for the time to load the patches and fix any issues they may cause. Thanks in advance for any help you can provide!

PS- We are using ISA at some sites, Netopia routers with built-in firewalls at some sites, and Linksys routers at some of the smaller sites.

If the firewall is a hardware device, it's very effective. Software based firewalls running on windows could be exploited with OS specific attacks. Non of my unpatched PCs behind a hardware based firewall have been exploited.

I'm using Norton Firewall, and Linkys BEFSX41 Firewall router on my personal PC that is unpatched. So far, I have not been affected. My firewall is blocking all attemtpts to use the RPC_DCOM buffer.

As long as you keep your ports like 135, 137 etc blocked you should be safe.

Usually the software firewall is "before" the demaons or programms or whatever you call them if you (as a packet) come in from the internet. The firewall should drop the packet before it ever even comes close to the programm that is vulnerable.

Thanks everyone, figured as much but thought it would be best to get a second opinion. :cool:

They are effective at blocking it until someone on your trusted network brings in a infected computer (such as a laptop from home). Then if you are not patched, you will get infected.

The hardware vs software based argument is fun and all...but in the end the firewall is as effective as the person who is administrating it.

I've been unaffected by the rpc problems with simple host firewalls such as tiny personal firewall.

That is not really an issue with most of our clients, we have a pretty tight lid on things coming in and going out. Our clients haven't really caught on to the whole laptop thing yet, I guess some are just technophobes. The only ones that use laptops don't connect them to the network, they just use them for internet access on the road and have their assistants email them documents that they need to work on.

The firewall will shield you from the external threat as long as its configured correctly but Id say you still need to always consider an internal threat.

Employees bringing in laptops that have been infected are only one aspect to consider. If you do not patch your internal system then there are several exploits freely available so that any user may gain root on any other unpatched system on the subnet. Also in the case of no virus protection/or misconfigured virus protection, could lead to an employee receving a worm via email or some other way which could in turn corrupt the whole subnet.

lemme tell how how u will be protected by the use of the firewall.....
1. by filtering/blocking the access to the port 135,137,445..u ensure the person is not able to sent the malformed data to ur PC to take the advantage of the hole, even if u are not patched.
2. by blocking all the ports except for the ones u require u ensure if anyhow the person has effectively, ie by using web browser or by sending u the attachment, exploited the hole...he is not able to take the advantage by installing trojan etc...

so firewall is a very effective solution but configure it properly

nJoy

I'm more worried about the external threat during the next week or so, they will be patched soon so it's not a big issue. My main question was more directed toward should I panic and run in there to patch stuff or wait until next week when I have more time. If an internal threat is unlikely during the next few days and the firewall will keep the nasties from coming in I would just assume not panic and disrupt my whole life to patch it today. :)

Dude,

Trust the Technology...Your firewall has you covered. Why hassle patching? Unless some of those systems will be going home with employees etc., then I can see you "billing".

Humbly,
retfarcratS

It's no trouble or extra work to add it onto the batch file with the rest of the patches, no sense leaving a hole if I am going to be there applying 25 other patches. As far as I am concerned there is no sense in patching it now if the firewall has it covered but it will be patched when I am doing the others mostly because I am worried about other viruses that spread via email coming onto the scene in the coming weeks/months that have the potential to attack machines inside the firewall.

Quote:

---

Originally posted here by retfarcratS
Dude,

Trust the Technology...Your firewall has you covered. Why hassle patching? Unless some of those systems will be going home with employees etc., then I can see you "billing".

Humbly,
retfarcratS

---

nah i wont advise this...do patch urself....always be on the safe side....

I agree....safe is best.

but, FACT: His firewall IS protecting him.

The plan was to patch anyway, the point of this thread was to help determine priority and time frame.

its cool ese

just giving my 2cents

I am beginning to suspect that Null Device has a bot running in my mind :D


You must patch if you know about them and that they are relevant to your workplace. Hell, it is much more difficult to fire a guy who followed the instructions on the packet?

Say you don't, and things go wrong....what defence do you have?

just my jaundiced opinion?


I have worked with albatrosses................they **** from a great height :(

Good Luck

nihil is right, if you are getting payed, do your job. If I were your boss and you cost me a truck load of money, start looking for a new job at Jack in Box. If it's your money we are talking about, its your packet of cash. Do as you think best. But good jobs are hard to find when you've cost somebody $. Good luck.

Freddy (show me the Money)

Cheers, Fred & NullDevice...........

I am not normally into politics & stuff, but I do think that this is a useful dialogue...it is about what we do for a living, after all?

God bless you all................I need some sack time

Cheers

As a side not: Check out DCOMbobulator to fix the RPC hole.
Link to information about DCOMbobulator
Link to download DCOMbobulator (Free)

One thing I was wondering about....

Can the RPC exploit be redirected to attack through a different port?

If the next worm attacks thru a different port then setting your router to close port 135 and the two other ports mentioned won't protect your system.

The next RPC exploit is on the way... closing port 135 was a very common initial response... will the next exploit take this into acount if it can?

noahsarc:
No, it can't.

Quote:

---

Originally posted here by nihil
I am beginning to suspect that Null Device has a bot running in my mind :D

---

i wonder on which port :D

In a small network where you have a good idea of how laptops are being used, the firewall should be fine.. but then there's no reason not to apply patches on a small network because it won't take much time.

On a large or global network with lots of laptop users, the firewall will probably only buy you some time before some dumbass unpatched user infects you.

However, you're making a dangerous assumption about the "RPC II Worm" if you assume that it will just come as a worm based on MSBlast and Nachi experiences. If the worm carries a mass-mailer component, then your firewall will probably not do a whole lot of good. Imagine something like Sobig.E (mails itself as a ZIP file to avoid firewall blocking and AV disinfection) combined with a Nachi-style worm. You'd probably get infected within a couple of hours tops. Even with external virus scanning (e.g. Messagelabs) you run a risk of infection with a fast spreading blended attack.

In other words.. patch as much as you can as quickly as you can. The best protection is "in depth" security where there are several layers of protection.

The firewall is great as one layer, but don't rely only on a fire wall, we got hit by slammer on soem of our new installas of MSSQL by the virus being spoofing an internal IP, add to that the continued sofistication of virus writers, eventualy something is going to come in on port 53 or 80.

To give you a better overview of the offices in question:

Offices are between 2 users and 70 users (nothing really to big, the big one w/70 users is almost all Win98 and the other machines in the office have been patched so they are safe).
All are protected by a hardware device or ISA.
No access from the outside except Outlook Web Access.
Only one person is actively using VPN and they are using Win98 from outside and going into the network above that is mostly 98.
All ports are closed unless explicitly needed (80, 25, 110, and maybe 1-2 more at each client).
All patches are applied about 1 month after release (mostly to provide a break-in period and allow M$ to finally get it right :D ), critical patches are applied sooner as needed, service packs are applied on a schedule set by current patch status of the machine (ie. if the machine is missing a lot of patches it will be done soon, if it is pretty well patched I will wait a few weeks and do vulnerable clients first).
Our clients have websites hosted offsite with the exception of Outlook Web Access, this hopefully gives one less entry way into the network.


Just remember, you can't show up every week and put in 15 hours of labor at $75-200/hr (depending on who you are) just because M$ is ghey.......in today's rough economy you have to be cost effective, if not the client sends you packing. :(