plugging old IIS FTP holes

Hi there,

I just finished running a Nessus scan against a new server I'm bringing up. One of the "high" risk factor warning I received was this:

It may be possible to make the remote FTP server crash by sending the command 'STAT *?AAA...AAA. An attacker may use this flaw to prevent your site from distributing files
*** Warning : we could not verify this vulnerability.

• Nessus solely relied on the banner of this server Solution : Apply the relevant hotfix from Microsoft See:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp

I went to Microsofts website and downloaded the appropriate patch. When I went to install it, the installation failed because the patch will not install on a server that has a newer Service Pack than SP2.

Any ideas how I can fix this hole without applying the patch? (Or, is there an alternate patch for SP3 users?)

Sincerely,

Douglas Schlenker