|
Posted by Torgeir Bakken \(MVP\) on October 13, 2005, 11:23 am
If you were Registered and logged in, you could reply and use other advanced thread options
Pat wrote:
> I have a web server that is currectly being scanned by a third party using
> ISS, they are flagging one exploit which is WinRpcssDcomBo: Microsoft Windows
> RPCSS DCOM buffer overflow (824146-MS03-039)
>
> I have seen other posts where people are reporting that SP1 somehow removes
> this patch? But I see that this patch should be included in SP1
>
> When I look in the registry I do not see any of the folders referenced like:
>
> Window Server 2003\SP1\KB824146
> nor do I see
> Window Server 2003\SP1\KB823980
> and the file versions are greater then the ones discussed to verify patch
> has been installed
>
> 1. I would like to know is there a issue with SP1 and detection of this
> patch? (As I have seen simliar posts with same issue)
This is not a known issue, the SP1 installation overwrites the files
that is included in MS03-039 with newer versions of those files.
I would think the third party scanning program have a logical flaw for
this issue.
> 2. What can I use for a reference to verify this patch with SP1 ?(all
> documented are no good)
824146 (MS03-039) is listed here as included in SP1:
Windows Server 2003 Service Pack 1 list of updates
http://support.microsoft.com/kb/824721/
As long as the following files (in the System32 folder) have a version
number of 5.2.3790.1830 or higher, you are good:
ole32.dll
rpcrt4.dll
rpcss.dll
(MS05-051/KB902400 will upgrade the version number to 5.2.3790.2492 for
ole32.dll and rpcss.dll).
>
> 3. Can the patch be reapplied when the system already has SP1 installed?
No, but installing MS05-051/KB902400 is an option, it supersedes
MS03-039:
Vulnerabilities in MSDTC and COM+ Could Allow Remote Code
Execution (902400)
http://www.microsoft.com/technet/security/Bulletin/MS05-051.mspx
--
torgeir, Microsoft MVP Scripting, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx
| 
XML site map