[Dshield] Obscure question

Radek_cz empee at xs4all.nl
Mon Mar 15 21:21:46 GMT 2004


hi

port 1720 reminds of the recent H.323 vulnerabilities:
http://www.kb.cert.org/vuls/id/749342

regards
Radek_cz


At 20:26 15-03-2004, you wrote:
>Hey Paul, List,
>
>Just to clarify--he's got open ports with no apparent service listening?
>How incredibly weird.  I haven't got any info for you, but my curiosity is 
>piqued--please be sure and let us know how it turns out.
>
>Regards,
>Pete
>
>Paul Marsh <pmarsh at nmefdn.org> wrote:
>I know this is a totally off the wall question but here goes. I've got
>clean Win2k install all SP's loaded, NAV 100% up to date. Gave it to a
>user who plugged it in to his cable modem and then started the install
>of ZoneAlarm. Now I told him to install and config ZoneAlarm prior to
>plugging into the modem but, well enough said.... Anyway I gave him a
>quick scan and found the following ports open 21 FTP, 389 Ldap, 1002
>Unassigned and 1720 Netmeeting. I asked him to see what was listening
>via netstat but nothing is listening on these ports? I asked him to
>un-install and re-install ZoneAlarm making sure that he does not let
>anything have access to the internet. Well the system is backup with
>the same ports open? He's done a GRC, Broadband and Sygate scan himself
>and found nothing open? Tonight I'm going to Nmap the machine to see
>what's cook'in but in the mean time does anyone have any ideas as to
>what might be going on?
>
>Thanx, Paul
>
>_______________________________________________
>list mailing list
>list at dshield.org
>To change your subscription options (or unsubscribe), see: 
>http://www.dshield.org/mailman/listinfo/list
>Do you Yahoo!?
>Yahoo! Mail - More reliable, more storage, less spam
>_______________________________________________
>list mailing list
>list at dshield.org
>To change your subscription options (or unsubscribe), see: 
>http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list