FrontPage Flaw Lets Hackers In

 
 
By Dennis Fisher  |  Posted 2002-09-26 Email Print this article Print
 
 
 
 
 
 
 

Flaw in Microsoft's FrontPage Server Extensions lets attackers run code on vulnerable Web servers.

A newly discovered flaw in Microsoft Corp.s FrontPage Server Extensions gives an attacker the ability to run any code of choice on some vulnerable Web servers. Microsoft issued an advisory and a patch for the problem Wednesday. The vulnerability is in the SmartHTML Interpreter in FPSE 2000 and 2002 and involves the way the interpreter handles requests for some Web files. The interpreter is designed to provide support for Web forms and other dynamic Web content.
In FPSE 2000, a malformed request would have a denial-of-service effect on the server, consuming all, or nearly all, of its available resources. In the newer version, exploitation of the flaw would cause a buffer overrun and give an attacker the ability to run any code of choice on the machine.
FPSE installs by default with IIS 4, 5 and 5.1. Microsoft said in an advisory on the problem that its IIS Lockdown Tool disables the SmartHTML Interpreter when applied to a static Web server. The patch for this vulnerability is available here.
Related Stories:
  • Microsoft Posts Steps to Change XP Keys
  • More Security Coverage
  •  
     
     
     
     
     
     
     
     
     
     

    Submit a Comment

    Loading Comments...

     
    Manage your Newsletters: Login   Register My Newsletters























     
     
     
     
     
     
     
     
     
     
     
    Rocket Fuel