LLSSRV Redux
With regards to the LLSSRV advisory Immunity published yesterday, we
would like to issue a clarification. There are two ways to get SP4 onto
a Windows 2000 Advanced Server machine, as follows:
1. Download SP4 from microsoft.com via networked or express install
2. Obtain and install a Windows 2000 Advanced Server CD or CD image that
includes SP4. This is available from the MSDN CD packages or online
download site. You may also have obtained such a CD from a vendor or
retailer.
The second way is vulnerable; the first way is not.
I.E. This advisory does not apply to Windows 2000 Advanced Server cases
where Service Pack 4 was installed separately.
We apologize for any confusion and thank those who pointed out that
installing SP4 manually will remove the registry key that allows for
anonymous remote access.
Reference Image:
http://www.immunitysec.com/downloads/win2kadvsrv_withSP4.jpg
Thanks,
Dave Aitel
VP Figureheads and Verbage
Immunity, Inc.