Buffer Overrun in SmartHTML Interpreter Could Allow Code Executio n (Q324096)

[maninder.bharadwaj () digital com (Bharadwaj, Maninder)]

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C26626.36AA575E
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

 =20


Buffer Overrun in SmartHTML Interpreter Could Allow Code Execution =
(Q324096)


Originally posted: September 25, 2002


Summary


Who should read this bulletin: Web site administrators using =
Microsoft=AE
FrontPage Server Extensions=20

Impact of vulnerability: Buffer overrun or denial of service=20

Maximum Severity Rating: Critical=20

Recommendation: Web site administrators should apply the patch or =
ensure
that the SmartHTML Interpreter is not available on the server.=20

Affected Software:=20

*       Microsoft FrontPage Server Extensions 2000=20
*       Microsoft FrontPage Server Extensions 2002=20
*       Microsoft Windows 2000 (shipped FPSE 2000)=20
*       Microsoft Windows XP (shipped FPSE 2000)=20

Technical details=20

Technical description:=20



The SmartHTML Interpreter (shtml.dll) is part of the FrontPage Server
Extensions (FPSE), and provides support for web forms and other
FrontPage-based dynamic content. The interpreter contains a flaw that =
could
be exposed when processing a request for a particular type of web file, =
if
the request had certain specific characteristics. This flaw affects the =
two
versions of FrontPage Server Extensions differently. On FrontPage =
Server
Extensions 2000, such a request would cause the interpreter to consume =
most
or all CPU availability until the web service was restarted. An =
attacker
could use this vulnerability to conduct a denial of service attack =
against
an affected web server. On FrontPage Server Extensions 2002, the same =
type
of request could cause a buffer overrun, potentially allowing an =
attacker to
run code of his choice.=20

Mitigating factors:=20

*       The IIS
<http://www.microsoft.com/technet/security/tools/locktool.asp> Lockdown
Tool, if used to configure a static web server, disables the SmartHTML
Interpreter. Servers on which this has been done could not be affected =
by
the vulnerability.=20
*       FrontPage Server Extensions install on IIS 4.0, 5.0 and 5.1 by
default, but can be uninstalled if desired. Servers on which this has =
been
done could not be affected by the vulnerability.=20

Severity Rating:=20

        Internet Servers         Intranet Servers        Client Systems=09
FrontPage Server Extensions 2000         Critical        Moderate
None=09
FrontPage Server Extensions 2002         Critical        Moderate
None=09
The above assessment
<http://www.microsoft.com/technet/security/topics/rating.asp>  is based =
on
the types of systems affected by the vulnerability, their typical =
deployment
patterns, and the effect that exploiting the vulnerability would have =
on
them.=20

Vulnerability identifier: CAN-2002-0692
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2002-0692> =20

Tested Versions:
Microsoft tested FrontPage Server Extensions 2000 and 2002 to assess =
whether
they are affected by these vulnerabilities. Previous versions are no =
longer
supported <http://support.microsoft.com/directory/discontinue.asp> , =
and may
or may not be affected by these vulnerabilities.

Frequently asked questions=20

What's the scope of the vulnerability?

This is a denial
<http://www.microsoft.com/technet/security/bulletin/glossary.asp> of =
service
and buffer overrun vulnerability. It affects FrontPage Server =
Extensions
2000 and 2002 differently. With FrontPage Server Extensions 2000, the =
flaw
could cause most CPU availability to be consumed until the web service =
is
restarted. An attacker could use this vulnerability to conduct a denial =
of
service attack against an affected web server. With FrontPage Server
Extensions 2002, the same flaw in the interpreter causes a buffer =
overrun,
potentially allowing an attacker to run code of the his choice.=20

Web site administrators who have used the IIS
<http://www.microsoft.com/technet/security/tools/locktool.asp> Lockdown =
Tool
to configure their servers as static web servers are already protected
against attacks that would attempt to exploit the vulnerability.=20

What causes the vulnerability?

The vulnerability results because of a flaw in the FrontPage Server
Extensions SmartHTML interpreter. The interpreter can enter a mode in =
which
it consumes all CPU availability on a web server using FrontPage Server
Extensions 2000 or can result in a buffer overrun in FrontPage Server
Extensions 2002, if it receives a request for a particular type of web =
file,
along with some specific parameters.

What are the FrontPage Server Extensions?

FrontPage
<http://msdn.microsoft.com/library/en-us/dnservext/html/fpovrw.asp> =
Server
Extensions (FPSE) is a set of tools that can be installed on a
FrontPage-based web site. They serve two basic functions: to allow
authorized personnel to manage the server, add or change content, and
perform other tasks; and to add functions that are frequently used by =
web
pages, such as search and forms support.=20

FPSE installs by default as part of IIS 4.0, 5.0 and 5.1. However, it =
can be
uninstalled if desired. Microsoft has long recommended that web
administrators uninstall FPSE if not needed.=20

What is the SmartHTML interpreter?

The SmartHTML interpreter, shtml.dll, is part of FPSE, and supports =
certain
types of dynamic web content. For instance, using SmartHTML, a web =
developer
can build a web page that relies on FrontPage features, but not =
actually
have those features embedded within the page until a user requests it.

For example, a web developer might want to embed the current date and =
time
in a web page. In order to do that, the developer might use one of the
WebBot components that come with FrontPage. A WebBot component gives an
author CGI capabilities without writing CGI applications. The web page
author inserts a WebBot into an HTML page. What actually gets inserted =
is a
specially formatted HTML comment. A WebBot comment looks like a =
standard
HTML comment with special notation that identifies the WebBot and its
properties. You set the property values from a dialog box when the =
WebBot
gets inserted. Each WebBot has its own dialog. Microsoft calls the =
WebBot
notation SmartHTML, and HTML pages containing them SmartHTML pages.=20

A WebBot is "executed" when the FrontPage Editor saves the HTML page. A
FrontPage Server Extension app scans the page for embedded WebBot =
components
and replaces them with standard HTML text. As a result of this scanning
process, a new page is created containing the standard HTML text =
generated
from the WebBot components and the web visitor sees the date and time
rendered on the web page.

What's wrong with the SmartHTML interpreter?

If a request for a certain type of web file is made in a particular =
way, it
could have the effect on a web server using FrontPage Server Extensions =
2000
of causing the SmartHTML interpreter to cycle endlessly, consuming all =
of
the server's CPU availability and preventing the server from performing
useful work. On a web server using FrontPage Server Extensions 2002, =
this
same type of request could have the effect of causing a buffer overrun =
and
potentially allowing an attacker to run malicious code on that server.

What could an attacker do via this vulnerability?

In the case of FrontPage Server Extensions 2000, an attacker could use =
this
vulnerability to monopolize a server and prevent legitimate users from =
being
able to use the web server. In the case of FrontPage Server Extensions =
2002,
an attacker could potentially cause a buffer overrun on the web server.

How might an attacker exploit the vulnerability?

The attack itself would only require that the attacker levy a =
particular
type of request on the SmartHTML interpreter. Upon attempting to =
process the
request (in the case of FrontPage Server Extensions 2000), the =
interpreter
would begin to "freewheel", and would continue to do so until the
administrator stopped and restarted the web service. In some cases, it =
might
be necessary to reboot the system in order to do this. In the case of
FrontPage Server Extensions 2002, the request could cause a buffer =
overrun
in the interpreter and allow code of the attacker's choice to run in =
the
context of the interpreter.

If an attacker exploited the buffer overrun in FrontPage Server =
Extensions
2002, in what context would the hostile code run?

In the case of the buffer overrun in FrontPage Server Extensions 2002, =
the
malicious code would run as system, even though getting to system would =
take
a convoluted exploit. Nonetheless, it is possible to that an attacker =
could
create such an exploit and be running as system.

What steps could an administrator take to protect against the =
vulnerability?

Of course, the simplest way to eliminate the vulnerability is to =
install the
patch. But even if the patch were not installed, a server wouldn't be =
at
risk if FPSE had been uninstalled, or if the SmartHTML interpreter were =
not
in use. For instance, the IIS
<http://www.microsoft.com/technet/security/tools/locktool.asp> Lockdown
Tool, if used to configure a static web server, disables the =
interpreter.

How does the patch eliminate the vulnerability?

The patch causes the SmartHTML interpreter to reject the requests at =
issue
here, as they aren't valid requests.






























































Patch availability


Download locations for this patch=20

*       Microsoft FrontPage Server Extensions 2002 for all platforms
http://download.microsoft.com/download/FrontPage2002/fpse1002/1/W98NT42K=
MeXP
/EN-US/fpse1002.exe
<http://download.microsoft.com/download/FrontPage2002/fpse1002/1/W98NT42=
KMeX
P/EN-US/fpse1002.exe> =20
*       Microsoft FrontPage Server Extension 2000 for NT4
http://download.microsoft.com/download/fp2000fd2000/Patch/1/W9XNT4Me/EN-=
US/f
pse0901.exe
<http://download.microsoft.com/download/fp2000fd2000/Patch/1/W9XNT4Me/EN=
-US/
fpse0901.exe> =20
*       Microsoft FrontPage Server Extensions 2000 for Windows XP=20


*       http://www.microsoft.com/downloads/release.asp?ReleaseID=3D42995
<http://www.microsoft.com/downloads/release.asp?ReleaseID=3D42995> =20
*       Windows Update <http://windowsupdate.microsoft.com/> =20

*       Microsoft FrontPage Server Extensions 2000 for Windows 2000=20


*       http://www.microsoft.com/downloads/release.asp?ReleaseID=3D42954
<http://www.microsoft.com/downloads/release.asp?ReleaseID=3D42954> =20
*       Windows Update <http://windowsupdate.microsoft.com/> =20

Additional information about this patch=20

Installation platforms:=20
This patch can be installed on:=20

*       FrontPage Server Extensions 2002: The patch can be applied on all
platforms which support FrontPage Server Extensions 2002.=20
*       FrontPage Server Extensions 2000: The patches can be applied on the
following systems running FrontPage Server Extensions 2000 - Windows =
XP,
Windows 2000, and NT4.=20

Inclusion in future service packs:
The fix for this issue will be included in Windows 2000 SP4, Windows XP =
SP2
and any future service packs for FPSE 2002.=20

Reboot needed: Yes=20

Patch can be uninstalled:


*       FrontPage Server Extensions 2000 patches on Windows 2000 and Windows
XP can be uninstalled.=20
*       FrontPage Server Extensions 2000 patches for NT4 cannot be
uninstalled.=20
*       FrontPage Server Extensions 2002 patches cannot be uninstalled.=20

Superseded patches: None.=20

Verifying patch installation:=20

*       Users who are applying the patch on Windows 2000 or Windows XP
should refer to Q324096
<http://support.microsoft.com/default.aspx?scid=3Dkb;en-us;Q324096> =20
*       Users who are applying the patch for FrontPage Server Extensions
2000 please refer to Knoweldege Base article Q329085
<http://support.microsoft.com/default.aspx?scid=3Dkb;en-us;Q329085> =20
*       Users who are applying the patch for FrontPage Server Extensions
2002 please refer to Knoweldege Base article Q329086
<http://support.microsoft.com/default.aspx?scid=3Dkb;en-us;Q329086> =20

Caveats:
Users running FrontPage Server Extensions 2002 on any supported =
platform who
have not applied the latest update will need to apply the update before
installing this patch. To learn more about the update, please read =
Q317296
<http://support.microsoft.com/default.aspx?scid=3Dkb;en-us;Q317296> . =
To go
directly to the FrontPage Server Extensions 2002 Update, click here
<http://download.microsoft.com/download/FrontPage2002/fpse1001/1/W98NT42=
KMeX
P/EN-US/fpse1001.exe> .=20

Localization:
Localized versions of this patch are available at the locations =
discussed in
"Patch Availability".=20

Obtaining other security patches:=20
Patches for other security issues are available from the following
locations:=20

*       Security patches are available from the Microsoft
<http://www.microsoft.com/downloads/search.asp?Search=3DKeyword&Value=3D=
%27secur
ity_patch%27&OpSysID=3D1> Download Center, and can be most easily found =
by
doing a keyword search for "security_patch".=20
*       Patches for consumer platforms are available from the WindowsUpdate
<http://windowsupdate.microsoft.com/>  web site=20


Other information:=20


Acknowledgments=20

Microsoft thanks
<http://www.microsoft.com/technet/security/bulletin/policy.asp>  =
Maninder
Bharadwaj of Digital Defense Services part of Digital GlobalSoft Ltd. =
for
reporting this issue to us and working with us to protect customers.=20

Support:=20

*       Microsoft Knowledge Base article Q324096 discusses this issue and
will be available approximately 24 hours after the release of this =
bulletin.
Knowledge Base articles can be found on the Microsoft Online
<http://support.microsoft.com/?scid=3Dfh;en-us;kbhowto> Support web =
site.=20
*       Technical support is available from Microsoft
<http://support.microsoft.com/directory/question.asp?sd=3Dgn&fr=3D0> =
Product
Support Services. There is no charge for support calls associated with
security patches.=20

Security Resources: The Microsoft TechNet
<http://www.microsoft.com/technet/security/default.asp> Security Web =
Site
provides additional information about security in Microsoft products.=20

Exploit:=20
The exploit could be provided for research and educational purposes on
request.=20

Regards,

-------------------------------------------------
Maninder Bharadwaj
Senior Security Specialist- Digital Defense Services
Digital GlobalSoft Ltd.
(A subsidiary of Hewlett-Packard Co., USA)
Digital Park, Plot No. 39/40, Electronic City
Hosur Road, Bangalore - 561 229
-------------------------------------------------
Tel: +91 80 8528395 Ext 12171
Fax: +91 80 8528420
Email: maninder.bharadwaj () digital com
Web:  www.digitalglobalsoft.com



------_=_NextPart_001_01C26626.36AA575E
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">




<TITLE></TITLE>

<META content=3D"MSHTML 6.00.2600.0" name=3DGENERATOR></HEAD>
<BODY><!--StartFragment -->&nbsp;
<P></P>
<H2>Buffer Overrun in SmartHTML Interpreter Could Allow Code Execution=20
(Q324096)</H2>
<P><I><B>Originally posted:</B> September 25, 2002</I></P>
<H2>Summary</H2>
<BLOCKQUOTE>
  <P><B>Who should read this bulletin:</B> Web site administrators =
using=20
  Microsoft=AE FrontPage Server Extensions </P>
  <P><B>Impact of vulnerability:</B> Buffer overrun or denial of =
service </P>
  <P><B>Maximum Severity Rating:</B> Critical </P>
  <P><B>Recommendation:</B> Web site administrators should apply the =
patch or=20
  ensure that the SmartHTML Interpreter is not available on the server. =
</P>
  <P><B>Affected Software: </B></P>
  <UL>
    <LI>Microsoft FrontPage Server Extensions 2000 </LI>
    <LI>Microsoft FrontPage Server Extensions 2002 </LI>
    <LI>Microsoft Windows 2000 (shipped FPSE 2000) </LI>
    <LI>Microsoft Windows XP (shipped FPSE 2000) =
</LI></UL></BLOCKQUOTE>
<P><FONT color=3D#003399 size=3D2><B>Technical details</B></FONT> </P>
<BLOCKQUOTE><B>Technical description: </B><BR><BR>
  <P>The SmartHTML Interpreter (shtml.dll) is part of the FrontPage =
Server=20
  Extensions (FPSE), and provides support for web forms and other=20
  FrontPage-based dynamic content. The interpreter contains a flaw that =
could be=20
  exposed when processing a request for a particular type of web file, =
if the=20
  request had certain specific characteristics. This flaw affects the =
two=20
  versions of FrontPage Server Extensions differently. On FrontPage =
Server=20
  Extensions 2000, such a request would cause the interpreter to =
consume most or=20
  all CPU availability until the web service was restarted. An attacker =
could=20
  use this vulnerability to conduct a denial of service attack against =
an=20
  affected web server. On FrontPage Server Extensions 2002, the same =
type of=20
  request could cause a buffer overrun, potentially allowing an =
attacker to run=20
  code of his choice. </P>
  <P><B>Mitigating factors:</B> </P>
  <UL>
    <LI>The <A=20
    =
href=3D"http://www.microsoft.com/technet/security/tools/locktool.asp";>II=
S=20
    Lockdown Tool</A>, if used to configure a static web server, =
disables the=20
    SmartHTML Interpreter. Servers on which this has been done could =
not be=20
    affected by the vulnerability. </LI>
    <LI>FrontPage Server Extensions install on IIS 4.0, 5.0 and 5.1 by =
default,=20
    but can be uninstalled if desired. Servers on which this has been =
done could=20
    not be affected by the vulnerability. </LI></UL>
  <P><B>Severity Rating:</B>=20
  <TABLE cellSpacing=3D0 cellPadding=3D5 border=3D1>
    <TBODY>
    <TR>
      <TH class=3Dtabletext></TH>
      <TH class=3Dtabletext>Internet Servers</TH>
      <TH class=3Dtabletext>Intranet Servers</TH>
      <TH class=3Dtabletext>Client Systems</TH></TR>
    <TR>
      <TH class=3Dtabletext>FrontPage Server Extensions 2000</TH>
      <TD class=3Dtabletext>Critical</TD>
      <TD class=3Dtabletext>Moderate</TD>
      <TD class=3Dtabletext>None</TD></TR>
    <TR>
      <TH class=3Dtabletext>FrontPage Server Extensions 2002</TH>
      <TD class=3Dtabletext>Critical</TD>
      <TD class=3Dtabletext>Moderate</TD>
      <TD class=3Dtabletext>None</TD></TR></TBODY></TABLE>The above <A=20
  =
href=3D"http://www.microsoft.com/technet/security/topics/rating.asp";>ass=
essment</A>=20
  is based on the types of systems affected by the vulnerability, their =
typical=20
  deployment patterns, and the effect that exploiting the vulnerability =
would=20
  have on them. </P>
  <P><B>Vulnerability identifier:</B> <A=20
  =
href=3D"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2002-069=
2">CAN-2002-0692</A>=20
  </P>
  <P><B>Tested Versions:</B><BR>Microsoft tested FrontPage Server =
Extensions=20
  2000 and 2002 to assess whether they are affected by these =
vulnerabilities.=20
  Previous versions are no longer <A=20
  =
href=3D"http://support.microsoft.com/directory/discontinue.asp";>supporte=
d</A>,=20
  and may or may not be affected by these =
vulnerabilities.</P></BLOCKQUOTE>
<P><FONT color=3D#003399 size=3D2><B>Frequently asked questions =
</B></FONT></P>
<BLOCKQUOTE>
  <P><B>What&#8217;s the scope of the vulnerability?</B></P>
  <P>This is a <A=20
  =
href=3D"http://www.microsoft.com/technet/security/bulletin/glossary.asp"=
> denial=20
  of service</A> and buffer overrun vulnerability. It affects FrontPage =
Server=20
  Extensions 2000 and 2002 differently. With FrontPage Server =
Extensions 2000,=20
  the flaw could cause most CPU availability to be consumed until the =
web=20
  service is restarted. An attacker could use this vulnerability to =
conduct a=20
  denial of service attack against an affected web server. With =
FrontPage Server=20
  Extensions 2002, the same flaw in the interpreter causes a buffer =
overrun,=20
  potentially allowing an attacker to run code of the his choice. </P>
  <P>Web site administrators who have used the <A=20
  =
href=3D"http://www.microsoft.com/technet/security/tools/locktool.asp";>II=
S=20
  Lockdown Tool</A> to configure their servers as static web servers =
are already=20
  protected against attacks that would attempt to exploit the =
vulnerability.=20
</P>
  <P><B>What causes the vulnerability?</B></P>
  <P>The vulnerability results because of a flaw in the FrontPage =
Server=20
  Extensions SmartHTML interpreter. The interpreter can enter a mode in =
which it=20
  consumes all CPU availability on a web server using FrontPage Server=20
  Extensions 2000 or can result in a buffer overrun in FrontPage Server =

  Extensions 2002, if it receives a request for a particular type of =
web file,=20
  along with some specific parameters.</P>
  <P><B>What are the FrontPage Server Extensions?</B></P>
  <P><A=20
  =
href=3D"http://msdn.microsoft.com/library/en-us/dnservext/html/fpovrw.as=
p">FrontPage=20
  Server Extensions</A> (FPSE) is a set of tools that can be installed =
on a=20
  FrontPage-based web site. They serve two basic functions: to allow =
authorized=20
  personnel to manage the server, add or change content, and perform =
other=20
  tasks; and to add functions that are frequently used by web pages, =
such as=20
  search and forms support. </P>
  <P>FPSE installs by default as part of IIS 4.0, 5.0 and 5.1. However, =
it can=20
  be uninstalled if desired. Microsoft has long recommended that web=20
  administrators uninstall FPSE if not needed. </P>
  <P><B>What is the SmartHTML interpreter?</B></P>
  <P>The SmartHTML interpreter, shtml.dll, is part of FPSE, and =
supports certain=20
  types of dynamic web content. For instance, using SmartHTML, a web =
developer=20
  can build a web page that relies on FrontPage features, but not =
actually have=20
  those features embedded within the page until a user requests it.</P>
  <P>For example, a web developer might want to embed the current date =
and time=20
  in a web page. In order to do that, the developer might use one of =
the WebBot=20
  components that come with FrontPage. A WebBot component gives an =
author CGI=20
  capabilities without writing CGI applications. The web page author =
inserts a=20
  WebBot into an HTML page. What actually gets inserted is a specially =
formatted=20
  HTML comment. A WebBot comment looks like a standard HTML comment =
with special=20
  notation that identifies the WebBot and its properties. You set the =
property=20
  values from a dialog box when the WebBot gets inserted. Each WebBot =
has its=20
  own dialog. Microsoft calls the WebBot notation SmartHTML, and HTML =
pages=20
  containing them SmartHTML pages. </P>
  <P>A WebBot is "executed" when the FrontPage Editor saves the HTML =
page. A=20
  FrontPage Server Extension app scans the page for embedded WebBot =
components=20
  and replaces them with standard HTML text. As a result of this =
scanning=20
  process, a new page is created containing the standard HTML text =
generated=20
  from the WebBot components and the web visitor sees the date and time =
rendered=20
  on the web page.</P>
  <P><B>What&#8217;s wrong with the SmartHTML interpreter?</B></P>
  <P>If a request for a certain type of web file is made in a =
particular way, it=20
  could have the effect on a web server using FrontPage Server =
Extensions 2000=20
  of causing the SmartHTML interpreter to cycle endlessly, consuming =
all of the=20
  server&#8217;s CPU availability and preventing the server from =
performing useful=20
  work. On a web server using FrontPage Server Extensions 2002, this =
same type=20
  of request could have the effect of causing a buffer overrun and =
potentially=20
  allowing an attacker to run malicious code on that server.</P>
  <P><B>What could an attacker do via this vulnerability?</B></P>
  <P>In the case of FrontPage Server Extensions 2000, an attacker could =
use this=20
  vulnerability to monopolize a server and prevent legitimate users =
from being=20
  able to use the web server. In the case of FrontPage Server =
Extensions 2002,=20
  an attacker could potentially cause a buffer overrun on the web =
server.</P>
  <P><B>How might an attacker exploit the vulnerability?</B></P>
  <P>The attack itself would only require that the attacker levy a =
particular=20
  type of request on the SmartHTML interpreter. Upon attempting to =
process the=20
  request (in the case of FrontPage Server Extensions 2000), the =
interpreter=20
  would begin to "freewheel", and would continue to do so until the=20
  administrator stopped and restarted the web service. In some cases, =
it might=20
  be necessary to reboot the system in order to do this. In the case of =

  FrontPage Server Extensions 2002, the request could cause a buffer =
overrun in=20
  the interpreter and allow code of the attacker&#8217;s choice to run =
in the context=20
  of the interpreter.</P>
  <P><B>If an attacker exploited the buffer overrun in FrontPage Server =

  Extensions 2002, in what context would the hostile code run?</B></P>
  <P>In the case of the buffer overrun in FrontPage Server Extensions =
2002, the=20
  malicious code would run as system, even though getting to system =
would take a=20
  convoluted exploit. Nonetheless, it is possible to that an attacker =
could=20
  create such an exploit and be running as system.</P>
  <P><B>What steps could an administrator take to protect against the=20
  vulnerability?</B></P>
  <P>Of course, the simplest way to eliminate the vulnerability is to =
install=20
  the patch. But even if the patch were not installed, a server =
wouldn&#8217;t be at=20
  risk if FPSE had been uninstalled, or if the SmartHTML interpreter =
were not in=20
  use. For instance, the <A=20
  =
href=3D"http://www.microsoft.com/technet/security/tools/locktool.asp";>II=
S=20
  Lockdown Tool</A>, if used to configure a static web server, disables =
the=20
  interpreter.</P>
  <P><B>How does the patch eliminate the vulnerability?</B></P>
  <P>The patch causes the SmartHTML interpreter to reject the requests =
at issue=20
  here, as they aren&#8217;t valid requests.</P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P>
  <P><B></B></P>
  <P></P></BLOCKQUOTE>
<H2>Patch availability</H2>
<BLOCKQUOTE><B>Download locations for this patch </B>
  <UL>
    <LI>Microsoft FrontPage Server Extensions 2002 for all platforms <A =

    =
href=3D"http://download.microsoft.com/download/FrontPage2002/fpse1002/1/=
W98NT42KMeXP/EN-US/fpse1002.exe">http://download.microsoft.com/download/=
FrontPage2002/fpse1002/1/W98NT42KMeXP/EN-US/fpse1002.exe</A>=20
    </LI>
    <LI>Microsoft FrontPage Server Extension 2000 for NT4 <A=20
    href=3D"http://download.microsoft.com/download/fp2000fd2000/Patch/1/=
W9XNT4Me/EN-US/fpse0901.exe">http://download.microsoft.com/download/fp20=
00fd2000/Patch/1/W9XNT4Me/EN-US/fpse0901.exe</A>=20
    </LI>
    <LI>Microsoft FrontPage Server Extensions 2000 for Windows XP=20
    <UL>
      <LI><A=20
      =
href=3D"http://www.microsoft.com/downloads/release.asp?ReleaseID=3D42995=
">http://www.microsoft.com/downloads/release.asp?ReleaseID=3D42995</A>=20
      </LI>
      <LI><A href=3D"http://windowsupdate.microsoft.com/";>Windows =
Update</A>=20
    </LI></UL></LI>
    <LI>Microsoft FrontPage Server Extensions 2000 for Windows 2000=20
    <UL>
      <LI><A=20
      =
href=3D"http://www.microsoft.com/downloads/release.asp?ReleaseID=3D42954=
">http://www.microsoft.com/downloads/release.asp?ReleaseID=3D42954</A>=20
      </LI>
      <LI><A href=3D"http://windowsupdate.microsoft.com/";>Windows =
Update</A>=20
    </LI></UL></LI></UL></BLOCKQUOTE>
<P><FONT color=3D#003399 size=3D2><B>Additional information about this=20
patch</B></FONT> </P>
<BLOCKQUOTE><B>Installation platforms: </B><BR>This patch can be =
installed on:=20

  <UL>
    <LI><B>FrontPage Server Extensions 2002</B>: The patch can be =
applied on all=20
    platforms which support FrontPage Server Extensions 2002. </LI>
    <LI><B>FrontPage Server Extensions 2000</B>: The patches can be =
applied on=20
    the following systems running FrontPage Server Extensions 2000 - =
Windows XP,=20
    Windows 2000, and NT4. </LI></UL>
  <P><B>Inclusion in future service packs:</B><BR>The fix for this =
issue will be=20
  included in Windows 2000 SP4, Windows XP SP2 and any future service =
packs for=20
  FPSE 2002. </P>
  <P><B>Reboot needed:</B> Yes </P>
  <P><B>Patch can be uninstalled:</B><BR></P>
  <UL>
    <LI>FrontPage Server Extensions 2000 patches on Windows 2000 and =
Windows XP=20
    can be uninstalled. </LI>
    <LI>FrontPage Server Extensions 2000 patches for NT4 cannot be =
uninstalled.=20
    </LI>
    <LI>FrontPage Server Extensions 2002 patches cannot be uninstalled. =
</LI></UL>
  <P><B>Superseded patches:</B> None. </P>
  <P><B>Verifying patch installation:</B> </P>
  <UL>
    <LI>Users who are applying the patch on Windows 2000 or Windows XP =
should=20
    refer to <A=20
    =
href=3D"http://support.microsoft.com/default.aspx?scid=3Dkb;en-us;Q32409=
6">Q324096</A>=20
    </LI>
    <LI>Users who are applying the patch for FrontPage Server =
Extensions 2000=20
    please refer to Knoweldege Base article <A=20
    =
href=3D"http://support.microsoft.com/default.aspx?scid=3Dkb;en-us;Q32908=
5">Q329085</A>=20
    </LI>
    <LI>Users who are applying the patch for FrontPage Server =
Extensions 2002=20
    please refer to Knoweldege Base article <A=20
    =
href=3D"http://support.microsoft.com/default.aspx?scid=3Dkb;en-us;Q32908=
6">Q329086</A>=20
    </LI></UL>
  <P><B>Caveats:</B><BR>Users running FrontPage Server Extensions 2002 =
on any=20
  supported platform who have not applied the latest update will need =
to apply=20
  the update before installing this patch. To learn more about the =
update,=20
  please read <A=20
  =
href=3D"http://support.microsoft.com/default.aspx?scid=3Dkb;en-us;Q31729=
6">Q317296</A>.=20
  To go directly to the FrontPage Server Extensions 2002 Update, click =
<A=20
  =
href=3D"http://download.microsoft.com/download/FrontPage2002/fpse1001/1/=
W98NT42KMeXP/EN-US/fpse1001.exe">here</A>.=20
  </P>
  <P><B>Localization:</B><BR>Localized versions of this patch are =
available at=20
  the locations discussed in "Patch Availability". </P>
  <P><B>Obtaining other security patches: </B><BR>Patches for other =
security=20
  issues are available from the following locations: </P>
  <UL>
    <LI>Security patches are available from the <A=20
    =
href=3D"http://www.microsoft.com/downloads/search.asp?Search=3DKeyword&a=
mp;Value=3D%27security_patch%27&amp;OpSysID=3D1">Microsoft=20
    Download Center</A>, and can be most easily found by doing a =
keyword search=20
    for "security_patch". </LI>
    <LI>Patches for consumer platforms are available from the <A=20
    href=3D"http://windowsupdate.microsoft.com/";>WindowsUpdate</A> web =
site=20
  </LI></UL></BLOCKQUOTE>
<H2>Other information: </H2>
<BLOCKQUOTE><B>Acknowledgments</B>
  <P>Microsoft <A=20
  =
href=3D"http://www.microsoft.com/technet/security/bulletin/policy.asp";>t=
hanks=20
  </A>&nbsp;Maninder Bharadwaj of Digital Defense Services part of =
Digital=20
  GlobalSoft Ltd. for reporting this issue to us and working with us to =
protect=20
  customers. </P>
  <P><B>Support: </B></P>
  <UL>
    <LI>Microsoft Knowledge Base article Q324096 discusses this issue =
and will=20
    be available approximately 24 hours after the release of this =
bulletin.=20
    Knowledge Base articles can be found on the <A=20
    =
href=3D"http://support.microsoft.com/?scid=3Dfh;en-us;kbhowto";>Microsoft=
 Online=20
    Support</A> web site. </LI>
    <LI>Technical support is available from <A=20
    =
href=3D"http://support.microsoft.com/directory/question.asp?sd=3Dgn&amp;=
fr=3D0">Microsoft=20
    Product Support Services</A>. There is no charge for support calls=20
    associated with security patches. </LI></UL>
  <P><B>Security Resources: </B>The <A=20
  =
href=3D"http://www.microsoft.com/technet/security/default.asp";>Microsoft=
 TechNet=20
  Security</A> Web Site provides additional information about security =
in=20
  Microsoft products. </P></BLOCKQUOTE>
<DIV><STRONG><FONT size=3D4>Exploit: </FONT></STRONG></DIV>
<DIV>The exploit could be provided for research and educational =
purposes on=20
request. <BR><BR><FONT face=3DArial color=3D#0000ff =
size=3D2>Regards,</FONT></DIV>
<P><FONT =
size=3D2>-------------------------------------------------<BR>Maninder=20
Bharadwaj<BR>Senior Security Specialist- Digital Defense =
Services<BR>Digital=20
GlobalSoft Ltd.<BR>(A subsidiary of Hewlett-Packard Co., =
USA)<BR>Digital Park,=20
Plot No. 39/40, Electronic City<BR>Hosur Road, Bangalore - 561=20
229<BR>-------------------------------------------------<BR>Tel: +91 80 =
8528395=20
Ext 12171<BR>Fax: +91 80 8528420<BR>Email:=20
maninder.bharadwaj () digital com<BR>Web:&nbsp;=20
www.digitalglobalsoft.com<BR></FONT></P></BODY></HTML>

------_=_NextPart_001_01C26626.36AA575E--