OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
RE: SUS server

From: Thane Walkup (twalkupquorumreview.com)
Date: Tue Apr 08 2003 - 09:40:57 CDT

Note that this still won't resolve the issue with 2k SP3 and XP SP1 -
the language of the license seems to give Microsoft unfettered access to
update your machines at will, not just via SUS. I'm not claiming that
Microsoft has a backdoor into XP or 2000, just saying that the language
of the license lets them do that.

Thanks,
Thane

-----Original Message-----
From: Brian W. Spolarich [mailto:bspolarichnephrostherapeutics.com]
Sent: Monday, April 07, 2003 11:31 AM
To: Thane Walkup; focus-mssecurityfocus.com
Subject: RE: SUS server

Thane Walkup wrote:
> One VERY good reason not to run SP3 is possible HIPAA and 21CFR11
> regulation issues - since the license for SP3 technically gives
> Microsoft unfettered access to your PC, any company under those
> regulations could be in violation of those regulations.
>
> This affects just about any medical facility.

  One can configure the SUS client to point at an internal SUS server
via Active Directory GPOs. I suspect that if you point it at a
non-functional URL the auto-update component will essentially be
disabled, and it may be possible to disable it completely via GPO
(haven't looked).

  -bws

<b>
----------------------------------------------------------------------
Block Spam, Smut & Viruses
SurfControl E-mail Filter for SMTP & Exchange leverages multiple layers
of
technology including filtering embedded and attached file content. Rid
your
enterprise of unwanted content.
http://www.securityfocus.com/SurfControl-focus-ms2
Download your free fully functional trial, complete with 30-days of free
technical support.
----------------------------------------------------------------------
</b>

<b>
----------------------------------------------------------------------
Block Spam, Smut & Viruses
SurfControl E-mail Filter for SMTP & Exchange leverages multiple layers of
technology including filtering embedded and attached file content. Rid your
enterprise of unwanted content.
http://www.securityfocus.com/SurfControl-focus-ms2
Download your free fully functional trial, complete with 30-days of free
technical support.
----------------------------------------------------------------------
</b>