Microsoft FrontPage Server Extensions contains denial of service vulnerability in the SmartHTML interpreter

Overview

The Microsoft FrontPage Server Extensions contains a vulnerability that allows unauthenticated remote attackers to conduct denial of service attacks.

Description

Microsoft FrontPage Server Extensions (FPSE) is an optional set of tools that adds functionality to a web site. This functionality includes remote server administration, content updates, and a variety of site-specific tools such as searching support and form handling. According to MS03-051, FPSE is installed by default on Internet Information Server (IIS) 4.0, 5.0, and 5.1.

The SmartHTML interpreter, a sub-component of FPSE, contains a denial of service vulnerability. According to Microsoft, a specially crafted request can cause the SmartHTML interpreter to enter a loop that will temporarily consume processor time and interrupt the normal operation of the server host.

---

Impact

This vulnerability allows unauthenticated remote attackers to conduct denial of service attacks against affected hosts.

---

Solution

Apply a patch from Microsoft

Microsoft has published Microsoft Security Bulletin MS03-051 to address this vulnerability. For a complete list of systems affected, please read the Microsoft bulletin.

---

Disable FrontPage Server Extensions

As a an interim measure, sites may reduce their exposure to this vulnerability by disabling FrontPage Server Extensions. Note that this may reduce the functionality of sites that utilize FPSE extensions.

Disable Internet Information Server

The IIS web server is installed by default on several versions of Microsoft Windows. As a general rule, the CERT/CC recommends that system administrators disable or remove any nonessential software. In this case, IIS should be removed from any host that is not expected to serve web pages.

---

Vendor Information

179012

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Notified: November 12, 2003 Updated: November 14, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Microsoft has published Microsoft Security Bulletin MS03-051 to address this vulnerability. For a complete list of systems affected, please read the Microsoft bulletin.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23179012 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/MS03-051.asp&gt;
• <http://www.secunia.com/advisories/10195/&gt;

Acknowledgements

This document was written by Jeffrey P. Lanza and is based upon information provided by Microsoft.

Other Information

CVE IDs:	CVE-2003-0824
Severity Metric:	3.09 Date Public: