Say, that's a nice bug MSFT...

Oh, dear...

Če zdej rečem "še dobr, da je Linux firewall pred strežniki" boš pa nalimal isto stvar še za Linux :|

Take zadeve so pomoje samo za targeted napade, ker dvomim, da bi se kdo šel ubadat s tako specifiko na splošni nivo naključnih online sistemov. Mislim, preveč truda, za nezagotovljen uspeh...

In kaj točno rabi OS vedeti v zvezi z zaprtim UDP portom? Me skrbi, da si zadeva ne alocira do 65k čudnih struktur...

Keep in mind that the only way your networking stack knows to reject packets that are directed towards closed ports is to do some preliminary parsing of those packets, namely allocating some control structures, receiving at least the physical/link layer frame, IP header, and transport layer header, and parsing out the port and destination address. There's plenty of things that can go wrong before the kernel decides "this is for a port that's not open" and drops it, which appears to be what happened here. -- quoted from the post on FD

Another workaround:
Since MS11-083 is only exploitable on closed UDP ports, start listening services on all ports to protect yourself.

HW FW/NAT/router itak uporablja nek embedded OS tako, da se situacija prav nič ne spremeni. Stealth port pa itak ni nič drugega kot closed port. S to razliko, da stealth port ignorira vse paketke medtem ko se closed port odzove z RST ali ICMP port unreachable.

@noraguta
ZDnet == rumenjak za IT folk :) Bolj zanimivo branje: KLIK