A newly discovered flaw in Microsoft Corp.s FrontPage Server Extensions gives an attacker the ability to run any code of choice on some vulnerable Web servers.
Microsoft issued an advisory and a patch for the problem Wednesday.
The vulnerability is in the SmartHTML Interpreter in FPSE 2000 and 2002 and involves the way the interpreter handles requests for some Web files. The interpreter is designed to provide support for Web forms and other dynamic Web content.
In FPSE 2000, a malformed request would have a denial-of-service effect on the server, consuming all, or nearly all, of its available resources. In the newer version, exploitation of the flaw would cause a buffer overrun and give an attacker the ability to run any code of choice on the machine.
FPSE installs by default with IIS 4, 5 and 5.1.
Microsoft said in an advisory on the problem that its IIS Lockdown Tool disables the SmartHTML Interpreter when applied to a static Web server.
The patch for this vulnerability is available here.
Related Stories:
- Microsoft Posts Steps to Change XP Keys
- More Security Coverage