DoS против IIS через FrontPage Server Extensions (Web Form Submission)

Определенный запрос к FPSE приводит к кразу IIS...

Security Bulletin MS00-100

Microsoft Security Bulletin MS00-100 Patch Available for “Malformed Web Form Submission” Vulnerability Originally posted: December 22, 2000 Summary Microsoft has released a patch that eliminates a security vulnerability in a component that ships as part of Microsoft® Internet Information Server...

CVE-2000-0709

The CVE-2000-0709 issue affects Microsoft FrontPage 2000 Server Extensions 1.1, specifically the shtml.exe component. A remote attacker can trigger a denial-of-service condition by requesting a URL whose path includes a standard DOS device name, leading to partial availability impact as described...

CVE-2000-0709: Undefined Security Weakness

The shtml.exe component of Microsoft FrontPage 2000 Server Extensions 1.1 allows remote attackers to cause a denial of service in some components by requesting a URL whose name includes a standard DOS device name...

CVE-2000-0710: Undefined Security Weakness

The shtml.exe component of Microsoft FrontPage 2000 Server Extensions 1.1 allows remote attackers to determine the physical path of the server components by requesting an invalid URL whose name includes a standard DOS device name...

Xato Advisory: FrontPage DOS Device DoS

----------------------------------------------------------------------- Xato Network Security, Inc. www.xato.net Security Advisory XATO-082000-01 August 17, 2000 FRONTPAGE SERVER EXTENSIONS SHTML.EXE DENIAL OF SERVICE --DOS Device DoS--...

IIS 5.0 cross site scripting vulnerability - using .shtml files or /_vti_bin/shtml.dll

Georgi Guninski security advisory 19, 2000 IIS 5.0 cross site scripting vulnerability - using .shtml files or /vtibin/shtml.dll This advisory describes two vulnerabilites one is already fixed by Microsoft but I decided to put them together. Systems affected: IIS 5.0/Windows 2000. Exploited with...

Translate:f summary, history and thoughts

Because Microsoft went the way of HIDING the actual mechanism of Translate:f from all of us original KB article is gone and new Security Bulletin is playing nasty game of downplaying the problem, i have decided to write follow up with sufficient information. HOW IT WORKS -------------------------...

shtml.exe reveal local path of IIS web directory

I found there is a security problem about shtml.exe that allows anyone to explore the local path of IIS web server. Tested on windows2000 server.shtml.exe is a program issued with Forntpage Extention server for viewing smart HTML file, If we install Frontpage on Windows2000 server, a directory...

Microsoft IIS FrontPage Server Extensions (FPSE) shtml.exe Path Disclosure

The version of FrontPage Extensions running on the remote host has an information disclosure vulnerability. Using a non-existent file as an argument to the 'shtml.exe' CGI reveals the local absolute path of the web root. A remote attacker could use this information to mount further attacks. C...

FrontPage 2000 IIS 4.05.0 - Server Extensions Full Path Disclosure

FrontPage 2000 IIS 4.05.0 - Server Extensions Full Path Disclosure source: https://www.securityfocus.com/bid/1174/info The local path of a HTML, HTM, ASP, or SHTML file can be disclosed in Microsoft IIS 4.0/5.0 / Frontpage Server Extensions 1.1 and prior. Passing a path to a non-existent file to...

FrontPage 2000 / IIS 4.0/5.0 - Server Extensions Full Path Disclosure

source: https://www.securityfocus.com/bid/1174/info The local path of a HTML, HTM, ASP, or SHTML file can be disclosed in Microsoft IIS 4.0/5.0 / Frontpage Server Extensions 1.1 and prior. Passing a path to a non-existent file to the shtml.exe or shtml.dll depending on platform program will displ...

CVE-2000-0256

Buffer overflows in htimage.exe and Imagemap.exe in FrontPage 97 and 98 Server Extensions allow a user to conduct activities that are not otherwise available through the web site, aka the "Server-Side Image Map Components" vulnerability...

CVE-2000-0256

The CVE-2000-0256 entry describes buffer overflows in FrontPage 97/98 Server Extensions, specifically htimage.exe (and Imagemap.exe) that allow a remote attacker to perform actions beyond the web site’s scope. A concrete exploit path is documented for htimage.exe via /cgi-bin/htimage.exe/AAAA[......

CVE-2000-0256: Undefined Security Weakness

Buffer overflows in htimage.exe and Imagemap.exe in FrontPage 97 and 98 Server Extensions allow a user to conduct activities that are not otherwise available through the web site, aka the "Server-Side Image Map Components" vulnerability...

Microsoft FrontPage 98 Server Extensions for IIS / Microsoft InterDev 1.0 - Filename Obfuscation

source: https://www.securityfocus.com/bid/1108/info Two dlls dvwssr.dll and mtd2lv.dll included with the FrontPage 98 extensions for IIS and shipped as part of the NT Option Pack include an obfuscation string that manipulates the name of requested files. Knowing this string and the obfuscation...

CVE-2000-0122

Frontpage Server Extensions allows remote attackers to determine the physical path of a virtual directory via a GET request to the htimage.exe CGI program...

CVE-2000-0114

Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /vtibin/ virtual directory...

CVE-2000-0122

CVE-2000-0122 affects FrontPage Server Extensions. A remote attacker can determine the physical path of a virtual directory by issuing a GET to htimage.exe, leading to information disclosure about server layout. The provided records do not specify affected versions, exact vulnerable component det...

CVE-2000-0114

CVE-2000-0114 affects FrontPage Server Extensions. It enables unauthenticated remote disclosure of the anonymous account name via an RPC POST to shtml.dll in the /_vti_bin/ virtual directory. The issue stems from information disclosure in FrontPage Server Extensions; no exploitation details are p...