RE: Frontpage Extensions Remote Command Execution

["Nick Jacobsen" <nick () ethicsdesign com>]

Has anyone even had any luck reproducing this?  I can't for the life of
me get a crash...

        -----Original Message----- 
        From: Geo. 
        Sent: Wed 11/12/2003 11:41 AM 
        To: full-disclosure () lists netsys com 
        Cc: 
        Subject: RE: [Full-Disclosure] Frontpage Extensions Remote
Command Execution
        
        

        >>
        Well, for one, it's not root level.  It allows ANONYMOUS (Guest)
access
        <<
        
        No it's not, IWAM is Web Applications MANAGER account you were
thinking of
        IUSR perhaps? This is not guest. This account can change
websites so in a
        multi host environment this level of access will allow a
compromise of every
        website on the server.
        
        Geo. (I'd call that root)
        
        _______________________________________________
        Full-Disclosure - We believe in it.
        Charter: http://lists.netsys.com/full-disclosure-charter.html

<<winmail.dat>>