RE: IIS and Frontpage Extensions Vulnerability.

From: Brett Moore (brett@softwarecreations.co.nz)
Date: 08/29/02 

From: "Brett Moore" <brett@softwarecreations.co.nz>
To: <focus-ms@securityfocus.com>
Date: Fri, 30 Aug 2002 09:47:02 +1200

Not forgetting the FPSE2000 Bof problem.
Patch: FrontPage Server Extension Sub-Component Contains Unchecked
Buffer<http://www.microsoft.com/technet/treeview/default.asp?url=/technet/se
curity/bulletin/MS01-035.asp>

Not sure off the top of my head if this is included in a service pack.? FP
service pack?

> -----Original Message-----
> From: Ken Schaefer [mailto:ken@adOpenStatic.com]
> Sent: Thursday, 29 August 2002 19:35
> To: focus-ms@securityfocus.com
> Subject: Re: IIS and Frontpage Extensions Vulnerability.
>
>
> Additionally,
>
> You could:
> a) change the NTFS permissions on those files
> b) you could change the IIS permissions so that "Execute" is not allowed
> etc
>
> As well the bulletin only mentions FPSE97 and FPSE98 as vulnerable...
>
> Since Win2k ships with FPSE2000 you shouldn't have a problem. Please see:
> http://www.microsoft.com/technet/treeview/default.asp?url=/technet
> /security/
> current.asp?productid=112&servicepackid=146&submit1=go&isie=yes
> (lists no bulletins that for FPSE2000)
>
> Cheers
> Ken
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> From: "Ivan Hernandez" <ivan.hernandez@globalsis.com.ar>
> Sent: Thursday, August 29, 2002 3:48 AM
> Subject: Re: IIS and Frontpage Extensions Vulnerability.
>
>
> : You can delete both files deleting the file protection cache at
> : \winnt\system32\dllcache (hidden dir)
> : Ivan Hernandez
> :
> : Kim, Cameron wrote:
> :
> : >Guys,
> : >
> : >I have a question regarding IIS 5.0 running on win2k server sp2.
> (frontpage
> : >extensions not installed)
> : >
> : >My Web Admin is a bit concerned because he has been trying to delete
> : >htimage.exe and imagemap.exe but stubborn windows file protection
> continues
> : >to replace it. He feels that the following vulnerabilities
> : >(http://online.securityfocus.com/bid/964
> : ><http://online.securityfocus.com/bid/964> )
> : > and
> :
> >http://www.microsoft.com/technet/treeview/default.asp?url=/techne
t/security
/
: >bulletin/fq00-028.asp
:
><http://www.microsoft.com/technet/treeview/default.asp?url=/technet/securit
y
: >/bulletin/fq00-028.asp> are still present, even though they are not
: >directly mentioned in the security bulletin.(given that the bulletin is
over
: >2 years old)
: >
: >Is his concern warranted? Or has one of the service packs fixed this
issue?
: >I am looking for some written proof pointing to the fact that this
: >vulnerability doesn't exists anymore. Thanks.
: >
: >
: >
: >Cameron Kim
: >Mitsubishi Digital Electronics America