Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Dave Aitel (daveimmunitysec.com)
Date: Thu Mar 17 2005 - 12:58:54 CST
With regards to the LLSSRV advisory Immunity published yesterday, we
would like to issue a clarification. There are two ways to get SP4 onto
a Windows 2000 Advanced Server machine, as follows:
1. Download SP4 from microsoft.com via networked or express install
2. Obtain and install a Windows 2000 Advanced Server CD or CD image that
includes SP4. This is available from the MSDN CD packages or online
download site. You may also have obtained such a CD from a vendor or
The second way is vulnerable; the first way is not.
I.E. This advisory does not apply to Windows 2000 Advanced Server cases
where Service Pack 4 was installed separately.
We apologize for any confusion and thank those who pointed out that
installing SP4 manually will remove the registry key that allows for
anonymous remote access.
VP Figureheads and Verbage