With regards to the LLSSRV advisory Immunity published yesterday, we would like to issue a clarification. There are two ways to get SP4 onto a Windows 2000 Advanced Server machine, as follows: 1. Download SP4 from microsoft.com via networked or express install 2. Obtain and install a Windows 2000 Advanced Server CD or CD image that includes SP4. This is available from the MSDN CD packages or online download site. You may also have obtained such a CD from a vendor or retailer. The second way is vulnerable; the first way is not. I.E. This advisory does not apply to Windows 2000 Advanced Server cases where Service Pack 4 was installed separately. We apologize for any confusion and thank those who pointed out that installing SP4 manually will remove the registry key that allows for anonymous remote access. Reference Image: http://www.immunitysec.com/downloads/win2kadvsrv_withSP4.jpg Thanks, Dave Aitel VP Figureheads and Verbage Immunity, Inc.
This archive was generated by hypermail 2.1.3 : Thu Mar 17 2005 - 13:17:35 PST