Errata

"Accessible TOP and UDP network services"

NOW READS:
"Accessible TCP and UDP network services"

The arrow going down from 'Network Enumeration' to 'New domain names and IP
addresses' HAS BEEN REVERSED and now points upward.

"Using half-open SYN flags to probe a target is known as an inverted technique because ... "

NOW READS::
"Using malformed TCP flags to probe a target is known as an inverted technique because ... "

"If some ports don't respond, but others respond with
RST/ACK, the unresponsive ports are considered unfiltered"

NOW READS:
"If some ports don't respond, but others respond with
RST/ACK, the responsive ports are considered unfiltered"

Table 5-1 should include the following two entries:

ZXFR denial-of-service CVE-2000-0887 8.2-8.2.2 patch level 6

Large TTL negative CVE-2003-0914 8.3-8.3.7 and 8.4-8.4.3
cache poisoning bug

snmpwalk -c public 192.168.0.1

NOW READS:
snmpwalk -c private 192.168.0.1

"snmpwalk -c public 192.168.0.1"

NOW READS:
"snmpwalk -c private 192.168.0.1"

http://www.example.org/scripts/..%255c../winnt/system32/cmd.exe/?/c+dir

NOW READS:
http://www.example.org/scripts/..%255c../winnt/system32/cmd.exe?/c+dir

The following sentence HAS BEEN ADDED to the end of the first paragraph, so that ti NOW READS:
" ... The iisoop.dll source code is available for analysis at
http://www.w00w00.org/files/iisoop.tgz. The bug reference is CVE-2002-0869
and MS02-062."

http://www.securityfocus.com/archive/75/295545/2003-09-07/2003-09-13/1
http://www.securityfocus.com/archive/75/337304/2003-09-11/2003-09-17/1

NOW READ:
http://www.securityfocus.com/archive/75/295545
http://www.securityfocus.com/archive/75/337304

"/price.asp?ProductID=12984';EXEC%20master..xp_cmdshell'ping.exe
%20212.123.86.4"

HAS BEEN REFORMATTED so that it NOW APPEARS:
"/price.asp?ProductID=12984';EXEC%20master..xp_cmdshell'ping.exe%20212.123.86.4"

'net users' NOW READS 'net%20users'

"OpenSSH 3.7.1 contains buffer management errors"

NOW READS:
"OpenSSH 3.7 and prior contains buffer management errors"

"The service listens on UDP port 1434 and returns the IP address and port number"
should read:
"The service listens on UDP port 1434 and returns the server name and port number"

" , which relates to a remote vulnerability in MySQL 3.23.56 ..."

NOW READS:
" , which relates to a post-authentication vulnerability in MySQL 3.23.56
..."

To the list of ports (including loc-srv, netbios-ns, microsoft-ds, etc.),
NOW READS:

loc-srv 135/tcp
...
netbios-ssn 139/tcp
microsoft-ds 445/tcp
microsoft-ds 445/udp

"ncacn_http (RPC over HTTP on TCP port 80 or 593)"

NOW READS:
"ncacn_http (RPC over HTTP on TCP port 80, 593, or others)"

{222, 227, and in the index}
"Uriel" NOW READS "Urity"

paragraph;
" .. if the SAMR or LSARPC interfaces are accessible."

NOW READS:
" .. if the SAMR RPC interface is accessible."

Table 10-1 NOW INCLUDES CVE-2002-0906, as follows:

CVE-2002-0906 28/06/2002 Sendmail 8.12.4 and prior can be compromised
if running in a non-default
configuration, by an attacker using an
authoritative DNS server to provide
a malformed TXT record to the mail server upon
connecting.

(RDP running on TCP port 259)

NOW READS:
(RDP running on UDP port 259)

Table 12-1 is missing a bug in yppasswd, and currently reads:

100009 yppasswd Yes No No No CVE-2001-0779

should read:

100009 yppasswd Yes No Yes No CVE-2001-0779
CVE-2002-0357

Table 12-1 is missing three bugs in ttdbserverd, and currently reads:

100083 ttdbserverd Yes No Yes Yes CVE-2001-0717

should read:

100083 ttdbserverd Yes No Yes Yes CVE-1999-0003
CVE-2001-0717
CVE-2002-0677
CVE-2002-0679

The 'xoa' text at the top of Figure 13-16 should be 'x0a'

"Pointer to formal string"

NOW READS:
"Pointer to format string"

"Pointer to formal string"

NOW READS:
"Pointer to format string"

"25/tcp open smtp"

NOW READS:
"23/tcp open telnet"

The rsync service (port 873) is also susceptible to CAN-2003-0962, so
should read "see CVE-2002-0048 and CAN-2003-0962"

"2401 cvspserver Unix CVS service, vulnerable to a number of attacks"

should read:

"2401 cvspserver Unix CVS service, vulnerable to a number of attacks;
see CVE-2003-0015"

The rwhois service on TCP port 4321 is also susceptible CVE-2001-0838, so
should read "see CVE-2001-0838 and CVE-2001-0913"

The following should be added to Table A-2:

5135 objectserver IRIX ObjectServer service, can be used to add user
accounts on IRIX 6.2
and prior; see CVE-2000-0245