<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2650.12">
<TITLE>RE: Code Red 2 cleanup; reporting.. </TITLE>
</HEAD>
<BODY>
<BR>
<BR>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: Roeland Meyer [<A HREF="mailto:rmeyer@mhsc.com">mailto:rmeyer@mhsc.com</A>]</FONT>
<BR><FONT SIZE=2>Sent: Friday, August 10, 2001 11:22 AM</FONT>
<BR><FONT SIZE=2>To: 'up@3.am'; nanog@merit.edu</FONT>
<BR><FONT SIZE=2>Subject: RE: Code Red 2 cleanup; reporting.. </FONT>
</P>
<BR>
<BR>
<P><FONT SIZE=2>> From: up@3.am [<A HREF="mailto:up@3.am">mailto:up@3.am</A>]</FONT>
<BR><FONT SIZE=2>> Sent: Friday, August 10, 2001 8:09 AM</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> On Fri, 10 Aug 2001, Roeland Meyer wrote:</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> > Win2K boxen are ALWAYS running IIS. It doesn't matter </FONT>
<BR><FONT SIZE=2>> whether you have Pro</FONT>
<BR><FONT SIZE=2>> > or Server. ALL Win2K systems need to run the patch. MSFT </FONT>
<BR><FONT SIZE=2>> chose to integrate</FONT>
<BR><FONT SIZE=2>> > much of the IIS stuff into DLLs with other system critical </FONT>
<BR><FONT SIZE=2>> stuff. As a</FONT>
<BR><FONT SIZE=2>> > result, IIS can't be completely removed without killing off </FONT>
<BR><FONT SIZE=2>> other critical</FONT>
<BR><FONT SIZE=2>> > functions. Yes, what they proved in court is even more true </FONT>
<BR><FONT SIZE=2>> with Win2K than</FONT>
<BR><FONT SIZE=2>> > with Win98 (Duh! MSFT didn't lie, but they didn't tell the </FONT>
<BR><FONT SIZE=2>> whole truth</FONT>
<BR><FONT SIZE=2>> > either). WinXP is even more in that direction, from all reports.</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> I admit to knowing very little about Win2k, but on the only box I've</FONT>
<BR><FONT SIZE=2>> installed Win2k on, it doesn't *appear* to be running:</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> Port State Protocol Service</FONT>
<BR><FONT SIZE=2>> 135 open tcp loc-srv</FONT>
<BR><FONT SIZE=2>> 139 filtered tcp netbios-ssn</FONT>
<BR><FONT SIZE=2>> 445 open tcp microsoft-ds</FONT>
<BR><FONT SIZE=2>> 1025 open tcp list</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> ...unless it runs on one of those 3 other open ports? This was Win2k</FONT>
<BR><FONT SIZE=2>> Client, not server, BTW...perhaps you mean every Win2k Server?</FONT>
</P>
<P><FONT SIZE=2>Win2k proffesional can run IIS. Goto add remove programs -->add/remove windows components ---> IIS.</FONT>
<BR><FONT SIZE=2>You probably did not select the component on the install.</FONT>
<BR><FONT SIZE=2>So I guess that means that not every w2k box is vulnerable.</FONT>
</P>
<P><FONT SIZE=2>Tim</FONT>
</P>
</BODY>
</HTML>