topic Re: Windows RPC DCOM Overflow in Network Security

Windows RPC DCOM Overflow

ncamilli — Sun, 10 Mar 2019 11:29:07 GMT

On a daily basis, for as long as my logs go back (over a month), my 1811 router has been flagging %IPS-4-SIGNATURE: Sig:3327 Subsig:1 Sev:5 Windows RPC DCOM Overflow and Subsig:0 multiple times daily from all different external ip addresses on random ports to one of my inside ip on port 135.

Does anyone have any idea what is going on?

Thanks in advanced.

Re: Windows RPC DCOM Overflow

eddie.mitchell — Fri, 06 Feb 2009 21:46:32 GMT

It is probably the conficker/downadup worm or a variant attempting to propagate from infected systems out on the Internet. Make sure your Windows systems are all patched and you are blocking TCP ports 135 and 445 inbound to your networks.

Hope this helps.

Re: Windows RPC DCOM Overflow

ncamilli — Fri, 06 Feb 2009 22:13:05 GMT

Thanks.

Re: Windows RPC DCOM Overflow

yuliang13 — Mon, 16 Feb 2009 06:56:22 GMT

Well ,it's not actually advisable to publish netbios port (135-139,445) to the internet. Perhaps you should source limit it.

cheers