Gabrielle Dowling wrote > There may be more to it. We've had at least two incidents where the > patch manifest was confirmed but the boxes got infected. And, I don't > think the infection came through an email seed, as we block > executables > at the SMTP gateway. I have one confirmed vulnerable Win2K Server box where all the files match the manifest perfectly. Multiple boots, uninstall and reinstall the patch, upgrade to SP4 then add the patch - all with the same results. A fully patched, fully vulnerable system that needs to come offline. Bunches of machines failed patching on the first try even though they reported success. NT4 seemed especially prone to this. Win2K fared better but not perfectly. Only this one machine matches the manifest yet remains vulnerable. It would be infected many times over already if it weren't in a nice cozy small firewalled LAN environment lucky enough not to have been exposed by accident.
This archive was generated by hypermail 2b30 : Thu Aug 14 2003 - 21:04:57 PDT