PT-2000-1643 · Microsoft · Frontpage 2000 Server Extensions

Publicado 2000-10-20 · Atualizado 2017-07-12 · CVE-2000-0710

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft FrontPage 2000 Server Extensions version 1.1

Description The issue allows remote attackers to determine the physical path of the server components by requesting an invalid URL whose name includes a standard DOS device name. This is due to a flaw in the shtml.exe component.

Recommendations For Microsoft FrontPage 2000 Server Extensions version 1.1, consider restricting access to the shtml.exe component until a fix is available. As a temporary workaround, avoid using standard DOS device names in URLs to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2000-0710

Produtos afetados

Frontpage 2000 Server Extensions

Referências · 4

• http://archives.neohapsis.com/archives/bugtraq/2000-08/0288.html · Aviso do Fabricante
• http://securityfocus.com/bid/1608 · Aviso do Fabricante
• http://msdn.microsoft.com/workshop/languages/fp/2000/sr12.asp · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2000-0710 · Nota de Segurança