By sending a large string of characters, the dvwssr.dll can be overflowed. The buffer overflow was uncovered by CoreSDI. 5. In theory if you can get the hash of a user with the access, you can exploit the buffer overflow. Sniffing the NT LanMan password hash being sent by a legitimate FP98 user using L0phtcrack, and subsequently cracking the password would certainly give you the proper access to run the dll, and therefore elevate priviledges. This would of course mean that the sniffer would have to be located between the legit user and the target server, but is not beyond the realm of possibility.
Detection is quite simple.
The 500 error means dvwssr.dll is not present. Connection closed by foreign host. The connection closed means that you had the rights to run the DLL, but since no parameters were passed the connection was completed. Users of BindView's HackerShield can use the Rapid Fire Update released on the evening of April 14 to detect the presense of the DLL on their systems they manage. Microsoft's original recommendation of removal of the DLL still stands as this eliminates the vulnerability completely.