FrontPage Flaw Lets Hackers In
Flaw in Microsoft's FrontPage Server Extensions lets attackers run code on vulnerable Web servers.A newly discovered flaw in Microsoft Corp.s FrontPage Server Extensions gives an attacker the ability to run any code of choice on some vulnerable Web servers. Microsoft issued an advisory and a patch for the problem Wednesday. The vulnerability is in the SmartHTML Interpreter in FPSE 2000 and 2002 and involves the way the interpreter handles requests for some Web files. The interpreter is designed to provide support for Web forms and other dynamic Web content.
In FPSE 2000, a malformed request would have a denial-of-service effect on the server, consuming all, or nearly all, of its available resources. In the newer version, exploitation of the flaw would cause a buffer overrun and give an attacker the ability to run any code of choice on the machine.