Port Question 3

[djones2002]

Morning All...just ran a security vulnerability assesment program against one of my Win2k Pro machines. The program indicates the following ports are open:

135 epmap-DCE endpoint resolution
139 netbios SSN netbios
445 MS-DS

Anyone have any ideas on these? I know what the NetBios port is for, however, is it normal for the other two to be open?

Dennis Jones

 

[SgtB]

All normal for a windows 2000 machine.

135-139 are all netbios
445 is for MS directory services

All are huge vulnerabilites just waiting to be exploited.

For future reference here's a list of all registered ports.

http://www.iana.org/assignments/port-numbers

Then you can google them for known exploits, or just for more info. ________________________________________
Check out

http://www.security-forums.com

 

[djones2002]

Thanks for the heads up! What a great resource...

 

[sera]

djones2002 .... if SgtB helped you, you should probably thank him by giving him a star. You can do this by clicking the link at the bottom of the post that says....mark this post as a helpful/expert post! That way, he gets credit for being so helpful and other users like me know from the forum list that the post was helpful and answered.
As for me I found it very helpful and I will give SgtB a star. Great resource...thanx

Sera
I often believe that...
My computer is possessed!

 

[SgtB]

Hey thanks for the feedback Sera! I appreciate it!
________________________________________
Check out

http://www.security-forums.com

 

[djones2002]

Sera...thanks for the heads up. Perhaps if I'd read the boards more carefully (kicking myself!) I'd have done it earlier...SgtB: One star coming your way!

 

[PerryMc]

Just a little additional note, I monitor our firewall's alarm log to keep an eye on who's trying to do what. One of, if not THE, most popular ports people try to get in on is 445.

Smile anyway,
Perry.

 

[SgtB]

PerryMc is right. 135-139, 445 are easily exploitable for script kiddies out there. Gotta watch out!
Thanks for all the feedback I appreciate it, and am always glad to help
________________________________________
Check out

http://www.security-forums.com

 

[HKinNYC]

For a quick look at ports, the site Sgt8 provide is great. If you require more detail regarding a port what problems they pose and even some firewall recommendations, consider...

http://www.seifried.org/security/ports/

This is what they have about port 135

http://www.seifried.org/security/ports/0/135.html

 

[SgtB]

Consider it bookmarked! Thanks for the link. ________________________________________
Check out

http://www.security-forums.com

 

[HKinNYC]

It's all about the sharing. ^_^

And you're welcome.

 

[davidmulcair]

What vulnerability scanning utility did you use? (whats recommended?)

 

[SgtB]

For freebies use...

http://www.nessus.com

(the server needs to run of a *nix system)
or

http://www.nmap.org

(it has a windows port)

If you can afford it, you can go with some commercial products. If you're just starting out, try those two first. ________________________________________
Check out

http://www.security-forums.com