LLSSRV Redux

[Dave Aitel <dave () immunitysec com>]

With regards to the LLSSRV advisory Immunity published yesterday, we 
would like to issue a clarification. There are two ways to get SP4 onto 
a Windows 2000 Advanced Server machine, as follows:
1. Download SP4 from microsoft.com via networked or express install
2. Obtain and install a Windows 2000 Advanced Server CD or CD image that 
includes SP4. This is available from the MSDN CD packages or online 
download site. You may also have obtained such a CD from a vendor or 
retailer.

The second way is vulnerable; the first way is not.

I.E. This advisory does not apply to Windows 2000 Advanced Server cases 
where Service Pack 4 was installed separately.

We apologize for any confusion and thank those who pointed out that 
installing SP4 manually will remove the registry key that allows for 
anonymous remote access.

Reference Image: 
http://www.immunitysec.com/downloads/win2kadvsrv_withSP4.jpg

Thanks,
Dave Aitel
VP Figureheads and Verbage
Immunity, Inc.

>