It was a bad week for security vulnerabilities but you have the biggest problem. A major vulnerability was announced and it appeared at first to be a problem only for IIS systems. THIS WAS WRONG. ALL WINDOWS 2000 SYSTEMS ARE POTENTIALLY VULNERABLE. ALL WINDOWS 2000 PROFESSIONAL AND SERVER USERS SHOULD APPLY THE PATCH.
(Well, almost everyone. If you are running Service Pack 2 (SP2) of Windows 2000 then some of your systems may be incompatible with the patch and applying it will cause them to become unbootable. The Microsoft bulletin has details in the "Additional information about this patch" section on on how to check if you have one of these versions. Microsoft doesn't seem to have a remedy for such users, other than to apply SP3.)
Windows 2003 users who turned on automatic update notification should already have received an automatic critical update notification about this patch. The patch can be applied to SP2 and SP3 systems. If you're running SP1 or earlier you probably should have moved on before, so this is a good excuse to install SP3. The patch will be standard issue in SP4.
This is an unusual situation. Almost all vulnerabilities are discovered and patched long before they are exploited, but this is one of those rare "zero day attacks" in which we found out about the vulnerability the hard way, through an attack on a US Army web site. Because events unfolded so quickly, a lot of incomplete and inaccurate information came out in the initial stages. But we know now that this is a very serious problem and all Windows 2000 users should apply the patch as soon as possible.
Regards,
Tom
Image`fx
