Errata for Network Security Assessment

"Accessible TOP and UDP network services" NOW READS: "Accessible TCP and UDP network services"

The arrow going down from 'Network Enumeration' to 'New domain names and IP addresses' HAS BEEN REVERSED and now points upward.

"Using half-open SYN flags to probe a target is known as an inverted technique because ... " NOW READS:: "Using malformed TCP flags to probe a target is known as an inverted technique because ... "

"If some ports don't respond, but others respond with RST/ACK, the unresponsive ports are considered unfiltered" NOW READS: "If some ports don't respond, but others respond with RST/ACK, the responsive ports are considered unfiltered"

Table 5-1 should include the following two entries: ZXFR denial-of-service CVE-2000-0887 8.2-8.2.2 patch level 6 Large TTL negative CVE-2003-0914 8.3-8.3.7 and 8.4-8.4.3 cache poisoning bug

snmpwalk -c public 192.168.0.1 NOW READS: snmpwalk -c private 192.168.0.1

"snmpwalk -c public 192.168.0.1" NOW READS: "snmpwalk -c private 192.168.0.1"

http://www.example.org/scripts/..%255c../winnt/system32/cmd.exe/?/c+dir NOW READS: http://www.example.org/scripts/..%255c../winnt/system32/cmd.exe?/c+dir

The following sentence HAS BEEN ADDED to the end of the first paragraph, so that ti NOW READS: " ... The iisoop.dll source code is available for analysis at http://www.w00w00.org/files/iisoop.tgz. The bug reference is CVE-2002-0869 and MS02-062."

http://www.securityfocus.com/archive/75/295545/2003-09-07/2003-09-13/1 http://www.securityfocus.com/archive/75/337304/2003-09-11/2003-09-17/1 NOW READ: http://www.securityfocus.com/archive/75/295545 http://www.securityfocus.com/archive/75/337304

"/price.asp?ProductID=12984';EXEC%20master..xp_cmdshell'ping.exe %20212.123.86.4" HAS BEEN REFORMATTED so that it NOW APPEARS: "/price.asp?ProductID=12984';EXEC%20master..xp_cmdshell'ping.exe%20212.123.86.4"

'net users' NOW READS 'net%20users'

"OpenSSH 3.7.1 contains buffer management errors" NOW READS: "OpenSSH 3.7 and prior contains buffer management errors"

"The service listens on UDP port 1434 and returns the IP address and port number" should read: "The service listens on UDP port 1434 and returns the server name and port number"

" , which relates to a remote vulnerability in MySQL 3.23.56 ..." NOW READS: " , which relates to a post-authentication vulnerability in MySQL 3.23.56 ..."

To the list of ports (including loc-srv, netbios-ns, microsoft-ds, etc.), NOW READS: loc-srv 135/tcp ... netbios-ssn 139/tcp microsoft-ds 445/tcp microsoft-ds 445/udp

"ncacn_http (RPC over HTTP on TCP port 80 or 593)" NOW READS: "ncacn_http (RPC over HTTP on TCP port 80, 593, or others)" {222, 227, and in the index} "Uriel" NOW READS "Urity"

paragraph; " .. if the SAMR or LSARPC interfaces are accessible." NOW READS: " .. if the SAMR RPC interface is accessible."

Table 10-1 NOW INCLUDES CVE-2002-0906, as follows: CVE-2002-0906 28/06/2002 Sendmail 8.12.4 and prior can be compromised if running in a non-default configuration, by an attacker using an authoritative DNS server to provide a malformed TXT record to the mail server upon connecting.

(RDP running on TCP port 259) NOW READS: (RDP running on UDP port 259)

Table 12-1 is missing a bug in yppasswd, and currently reads: 100009 yppasswd Yes No No No CVE-2001-0779 should read: 100009 yppasswd Yes No Yes No CVE-2001-0779 CVE-2002-0357

Table 12-1 is missing three bugs in ttdbserverd, and currently reads: 100083 ttdbserverd Yes No Yes Yes CVE-2001-0717 should read: 100083 ttdbserverd Yes No Yes Yes CVE-1999-0003 CVE-2001-0717 CVE-2002-0677 CVE-2002-0679

The 'xoa' text at the top of Figure 13-16 should be 'x0a'

"Pointer to formal string" NOW READS: "Pointer to format string"

"Pointer to formal string" NOW READS: "Pointer to format string"

"25/tcp open smtp" NOW READS: "23/tcp open telnet"

The rsync service (port 873) is also susceptible to CAN-2003-0962, so should read "see CVE-2002-0048 and CAN-2003-0962"

"2401 cvspserver Unix CVS service, vulnerable to a number of attacks" should read: "2401 cvspserver Unix CVS service, vulnerable to a number of attacks; see CVE-2003-0015"

The rwhois service on TCP port 4321 is also susceptible CVE-2001-0838, so should read "see CVE-2001-0838 and CVE-2001-0913"

The following should be added to Table A-2: 5135 objectserver IRIX ObjectServer service, can be used to add user accounts on IRIX 6.2 and prior; see CVE-2000-0245