335906 - MS03-026_RPC_DCOM_EXPLOIT Issue when accessing above sit.

Status: RESOLVED WORKSFORME

(Firefox :: Security, defect)

Description

[jomar1943]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2

When we attempt to go to this site we had very slow response.  We disabled our personal firewall and received the notification from our virus program that a virus was detected.  It does not seem like a virus though and came up as the error above (MS03-026_RPC_DCOM_EXPLOIT).  We are using the latest version of Firefox and wanted to report this to see if it was an exploit that had not been fixed yet.  With the personal firewall running we never get the error, but the site takes a very long time (10 - 15 minutes) to load. 

Reproducible: Always

Steps to Reproduce:
1. Disable Personal Firewall, but keep virus security on
2. Go to site https://www.comsec.com.au/default.aspx
3. Receive popup error from Virus security (PC-cillin) that an exploit is being accessed.

Actual Results:  
Site is slow because of this exploit.  After the above steps, the error is received from PC-cillin and the site comes to a very slow load.

Expected Results:  
Site should load as it did before (before latest load of Firefox was loaded).

Not sure, but if it is an exploit we thought you should know about it.

Comment 1

[Bob Clary [:bc] (inactive)]

I downloaded the content of the homepage and did not see anything that resembled exploit code, and scanned the content with a virus scanner did not see any hits. The home page and prerequisites is about 143K, so if you have a slow connection it could take a while to load normally. On my Satellite connection, it loads fairly fast in Firefox 1.5.0.3. The site appears to a .Net site with various form validation functions including some XMLHttpRequest calls and could be slow on a slower machine however I expect any Windows XP class machine to handle it unless you have installed XP on a lower end machine.

MS03-026 is about a vulnerability in MS Windows RPC implementation and if you only see this after turning off your firewall I expect that someone is attempting to exploit your machine using this vulnerability in Windows. See <http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx>. Do you have a fully patched installation of Windows XP?

I expect that if you turn off your firewall without visiting the site or even opening up a browser you would see the same alert.

From what I can tell, this is not an issue with Firefox.