Security Bulletin MS00-100

Microsoft Security Bulletin MS00-100 Patch Available for “Malformed Web Form Submission” Vulnerability Originally posted: December 22, 2000 Summary Microsoft has released a patch that eliminates a security vulnerability in a component that ships as part of Microsoft® Internet Information Server...

fp-ext-dos.sh

Frontpage Server Extension shtml.exe DoS advisory by : www.Xato.net coded by : [email protected] Devices who can cause a machine to crash are com1, prn, aux http://grazer.gz.ee looking for a team to join Vulnerable: Microsoft Windows 98 Microsoft Windows 95 Microsoft Windows NT 4.0 Microsoft...

DoS против FrontPage server

При использовании имени DOS-устройства в названии HTML0документа при обращении к shtnl.exe вызывает отказ сервиса в обслуживании...

Xato Advisory: FrontPage DOS Device DoS

----------------------------------------------------------------------- Xato Network Security, Inc. www.xato.net Security Advisory XATO-082000-01 August 17, 2000 FRONTPAGE SERVER EXTENSIONS SHTML.EXE DENIAL OF SERVICE --DOS Device DoS--...

IIS 5.0 cross site scripting vulnerability - using .shtml files or /_vti_bin/shtml.dll

Georgi Guninski security advisory 19, 2000 IIS 5.0 cross site scripting vulnerability - using .shtml files or /vtibin/shtml.dll This advisory describes two vulnerabilites one is already fixed by Microsoft but I decided to put them together. Systems affected: IIS 5.0/Windows 2000. Exploited with...

Translate:f summary, history and thoughts

Because Microsoft went the way of HIDING the actual mechanism of Translate:f from all of us original KB article is gone and new Security Bulletin is playing nasty game of downplaying the problem, i have decided to write follow up with sufficient information. HOW IT WORKS -------------------------...

Очередной способ получить путь к файлам через FrontPage Server

Запросив у shtml.exe из каталога vtibin несуществующий файл можно получить путь к этому файлу...

shtml.exe reveal local path of IIS web directory

I found there is a security problem about shtml.exe that allows anyone to explore the local path of IIS web server. Tested on windows2000 server.shtml.exe is a program issued with Forntpage Extention server for viewing smart HTML file, If we install Frontpage on Windows2000 server, a directory...

Microsoft IIS FrontPage Server Extensions (FPSE) shtml.exe Path Disclosure

The version of FrontPage Extensions running on the remote host has an information disclosure vulnerability. Using a non-existent file as an argument to the 'shtml.exe' CGI reveals the local absolute path of the web root. A remote attacker could use this information to mount further attacks. C...

FrontPage 2000 / IIS 4.0/5.0 - Server Extensions Full Path Disclosure

source: https://www.securityfocus.com/bid/1174/info The local path of a HTML, HTM, ASP, or SHTML file can be disclosed in Microsoft IIS 4.0/5.0 / Frontpage Server Extensions 1.1 and prior. Passing a path to a non-existent file to the shtml.exe or shtml.dll depending on platform program will displ...

CVE-2000-0256

Buffer overflows in htimage.exe and Imagemap.exe in FrontPage 97 and 98 Server Extensions allow a user to conduct activities that are not otherwise available through the web site, aka the "Server-Side Image Map Components" vulnerability...

CVE-2000-0122

Frontpage Server Extensions allows remote attackers to determine the physical path of a virtual directory via a GET request to the htimage.exe CGI program...

CVE-2000-0114

Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /vtibin/ virtual directory...

CVE-2000-0122

CVE-2000-0122 affects FrontPage Server Extensions. A remote attacker can determine the physical path of a virtual directory by issuing a GET to htimage.exe, leading to information disclosure about server layout. The provided records do not specify affected versions, exact vulnerable component det...

CVE-2000-0114

CVE-2000-0114 affects FrontPage Server Extensions. It enables unauthenticated remote disclosure of the anonymous account name via an RPC POST to shtml.dll in the /_vti_bin/ virtual directory. The issue stems from information disclosure in FrontPage Server Extensions; no exploitation details are p...

CVE-2000-0122

Frontpage Server Extensions allows remote attackers to determine the physical path of a virtual directory via a GET request to the htimage.exe CGI program...

CVE-2000-0114

Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /vtibin/ virtual directory...

CVE-1999-1376

Buffer overflow in fpcount.exe in IIS 4.0 with FrontPage Server Extensions allows remote attackers to execute arbitrary commands...

Security Update for Windows XP (KB810217)

A security issue has been identified in FrontPage Server Extensions. This vulnerability could allow an attacker to run code of their choice on your system. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your...

Security Update for Windows 2000 (KB810217)

A security issue has been identified in FrontPage Server Extensions. This vulnerability could allow an attacker to run code of their choice on your system. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your...