[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <NHECKAGIIGOLMOGPKBOOIELKCHAA.dsoeder@eeye.com>
From: dsoeder at eeye.com (Derek Soeder)
Subject: Blaster: will it spread without tftp?
Hi Maarten,
> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Maarten
> Sent: Tuesday, August 12, 2003 1:19 PM
> To: full-disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] Blaster: will it spread without tftp?
>
[...]
>
> I also read something about SP0|1|2 on W2K not being vulnerable
> to msblaster
> (probably because of the "universal" offsets used). Is there
> anyone that can
> confirm this finding?
We've confirmed that Windows 2000 SP0-2 *are* vulnerable -- the "universal"
offset (0018759F) does work on every version of Windows 2000 we've tested,
which includes Windows 2000 Server (English) SP0-4 and Windows 2000 Pro
(Japanese), just for variety.
As far as I know, the only thing different about Windows 2000 SP0-2 in this
regard is that DCOM functionality cannot be disabled just by using DCOMCNFG.
-- Derek
Powered by blists - more mailing lists