I downloaded the new mssql_version.nasl this morning. I had to hack it around a little to make it work on 1.0.10 which is the version I am still running. However, it appears to have a flaw - not so much in the script itself, more the fact that it appears that all versions of SQL Server 2000 return a version string of 8.00.194 in response to the SQL ping. Even those that the admins swear blind are patched with SP3.
I guess thanks are due to MS for this one :-( BTW, to make it work on 1.0.10, apart from removing the line for script_version() which is invalid on 1.0, I also had to change the variable names "description[x]" because they conflicted with the "if (description)" at the top of the file. I got a warning message that description was first defined as scalar and it refused to run. Maybe this would also be a problem on 1.2 - I don't know but if you know about it then it can be checked. Trevor Hemsley, Security Specialist, Atos Origin Ltd, Whyteleafe, +44-(0)1883-628139 [This e-mail is privileged and may contain confidential information intended only for the person(s) named above. If you receive this e-mail in error, please notify the addressee immediately by telephone or return e-mail. Although the sender endeavours to maintain a computer virus free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.]
