PT-2000-1643 · Microsoft · Frontpage 2000 Server Extensions

Published 2000-10-20 · Updated 2017-07-12 · CVE-2000-0710

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft FrontPage 2000 Server Extensions version 1.1

Description The issue allows remote attackers to determine the physical path of the server components by requesting an invalid URL whose name includes a standard DOS device name. This is due to a flaw in the shtml.exe component.

Recommendations For Microsoft FrontPage 2000 Server Extensions version 1.1, consider restricting access to the shtml.exe component until a fix is available. As a temporary workaround, avoid using standard DOS device names in URLs to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2000-0710

Affected Products

Frontpage 2000 Server Extensions

References · 4

• http://archives.neohapsis.com/archives/bugtraq/2000-08/0288.html · Vendor Advisory
• http://securityfocus.com/bid/1608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-0710 · Security Note
• http://msdn.microsoft.com/workshop/languages/fp/2000/sr12.asp · Note