Dell OMI (Open Manage Instrumentation)

From: nemo55at_private
Date: Fri Jun 01 2001 - 14:54:44 PDT

  • Next message: Brian Nottle: "Re: Penetration test report - your comments please?"

    First there was the Compaq 2301 hack...
    
    I wonder if anyone has found any security holes in the DELL Open Manage 
    Client.  We are a large DELL shop with many 95/98/NT/W2K machines that 
    have the DELL OMI client installed.  There are several  UDP/TCP  ports open 
    at all times:
    
    The ports and associated pgms are:
    1037  tcp  win32sl.exe
    1039  tcp win32sl.exe
    
    1026  udp  dnar.exe
    1038  udp  win32sl.exe
    
    Visiting the DELL web site shows a remote cmd program by the name of  actionagent.exe
    
    (http://docs.us.dell.com/docs/software/omci60/en/ug/comp.htm)
    
    Since I did not find that pgm opening any ports on our NT servers, I 
    think (guess or hope ?) that no remote attack is possible.
    
    But since the example of the COMPAQ 2301 hack - I wonder if  there is 
    still a hack waiting to be found in the DELL OMI client.
    
    anyone ?
    
    thanks
    
    
    Free, encrypted, secure Web-based email at www.hushmail.com
    
    
    IMPORTANT NOTICE:  If you are not using HushMail, this message could have been read easily by the many people who have access to your open personal email messages.
    Get your FREE, totally secure email address at http://www.hushmail.com.
    



    This archive was generated by hypermail 2b30 : Sat Jun 02 2001 - 06:54:48 PDT