RE: [Full-Disclosure] Blaster: will it spread without tftp?

["Derek Soeder" <dsoeder@eeye.com>]

Hi Maarten,

> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com
> [mailto:full-disclosure-admin@lists.netsys.com]On Behalf Of Maarten
> Sent: Tuesday, August 12, 2003 1:19 PM
> To: full-disclosure@lists.netsys.com
> Subject: [Full-Disclosure] Blaster: will it spread without tftp?
>
[...]
>
> I also read something about SP0|1|2 on W2K not being vulnerable
> to msblaster
> (probably because of the "universal" offsets used). Is there
> anyone that can
> confirm this finding?


We've confirmed that Windows 2000 SP0-2 *are* vulnerable -- the "universal"
offset (0018759F) does work on every version of Windows 2000 we've tested,
which includes Windows 2000 Server (English) SP0-4 and Windows 2000 Pro
(Japanese), just for variety.

As far as I know, the only thing different about Windows 2000 SP0-2 in this
regard is that DCOM functionality cannot be disabled just by using DCOMCNFG.

-- Derek

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html