What’s the scope of the vulnerability?
This is a
denial of service and buffer overrun vulnerability. It affects
FrontPage Server Extensions 2000 and 2002 differently. With FrontPage
Server Extensions 2000, the flaw could cause most CPU availability to be
consumed until the web service is restarted. An attacker could use this
vulnerability to conduct a denial of service attack against an affected
web server. With FrontPage Server Extensions 2002, the same flaw in the
interpreter causes a buffer overrun, potentially allowing an attacker to
run code of the his choice.
Web site administrators who have used the
IIS Lockdown Tool to configure their servers as static web servers
are already protected against attacks that would attempt to exploit the
vulnerability.
What causes the vulnerability?
The vulnerability results because of a flaw in the FrontPage Server
Extensions SmartHTML interpreter. The interpreter can enter a mode in
which it consumes all CPU availability on a web server using FrontPage
Server Extensions 2000 or can result in a buffer overrun in FrontPage
Server Extensions 2002, if it receives a request for a particular type
of web file, along with some specific parameters.
What are the FrontPage Server Extensions?
FrontPage Server Extensions (FPSE) is a set of tools that can be
installed on a FrontPage-based web site. They serve two basic functions:
to allow authorized personnel to manage the server, add or change
content, and perform other tasks; and to add functions that are
frequently used by web pages, such as search and forms support.
FPSE installs by default as part of IIS 4.0, 5.0 and 5.1. However, it
can be uninstalled if desired. Microsoft has long recommended that web
administrators uninstall FPSE if not needed.
What is the SmartHTML interpreter?
The SmartHTML interpreter, shtml.dll, is part of FPSE, and supports
certain types of dynamic web content. For instance, using SmartHTML, a
web developer can build a web page that relies on FrontPage features,
but not actually have those features embedded within the page until a
user requests it.
For example, a web developer might want to embed the current date and
time in a web page. In order to do that, the developer might use one of
the WebBot components that come with FrontPage. A WebBot component gives
an author CGI capabilities without writing CGI applications. The web
page author inserts a WebBot into an HTML page. What actually gets
inserted is a specially formatted HTML comment. A WebBot comment looks
like a standard HTML comment with special notation that identifies the
WebBot and its properties. You set the property values from a dialog box
when the WebBot gets inserted. Each WebBot has its own dialog. Microsoft
calls the WebBot notation SmartHTML, and HTML pages containing them
SmartHTML pages.
A WebBot is "executed" when the FrontPage Editor saves the HTML page.
A FrontPage Server Extension app scans the page for embedded WebBot
components and replaces them with standard HTML text. As a result of
this scanning process, a new page is created containing the standard
HTML text generated from the WebBot components and the web visitor sees
the date and time rendered on the web page.
What’s wrong with the SmartHTML interpreter?
If a request for a certain type of web file is made in a particular
way, it could have the effect on a web server using FrontPage Server
Extensions 2000 of causing the SmartHTML interpreter to cycle endlessly,
consuming all of the server’s CPU availability and preventing the server
from performing useful work. On a web server using FrontPage Server
Extensions 2002, this same type of request could have the effect of
causing a buffer overrun and potentially allowing an attacker to run
malicious code on that server.
What could an attacker do via this vulnerability?
In the case of FrontPage Server Extensions 2000, an attacker could
use this vulnerability to monopolize a server and prevent legitimate
users from being able to use the web server. In the case of FrontPage
Server Extensions 2002, an attacker could potentially cause a buffer
overrun on the web server.
How might an attacker exploit the vulnerability?
The attack itself would only require that the attacker levy a
particular type of request on the SmartHTML interpreter. Upon attempting
to process the request (in the case of FrontPage Server Extensions
2000), the interpreter would begin to "freewheel", and would continue to
do so until the administrator stopped and restarted the web service. In
some cases, it might be necessary to reboot the system in order to do
this. In the case of FrontPage Server Extensions 2002, the request could
cause a buffer overrun in the interpreter and allow code of the
attacker’s choice to run in the context of the interpreter.
If an attacker exploited the buffer overrun in FrontPage Server
Extensions 2002, in what context would the hostile code run?
In the case of the buffer overrun in FrontPage Server Extensions
2002, the malicious code would run as system, even though getting to
system would take a convoluted exploit. Nonetheless, it is possible to
that an attacker could create such an exploit and be running as system.
What steps could an administrator take to protect against the
vulnerability?
Of course, the simplest way to eliminate the vulnerability is to
install the patch. But even if the patch were not installed, a server
wouldn’t be at risk if FPSE had been uninstalled, or if the SmartHTML
interpreter were not in use. For instance, the
IIS Lockdown Tool, if used to configure a static web server,
disables the interpreter.
How does the patch eliminate the vulnerability?
The patch causes the SmartHTML interpreter to reject the requests at
issue here, as they aren’t valid requests.
Installation platforms:
This patch can be installed on:
- FrontPage Server Extensions 2002: The patch can be applied
on all platforms which support FrontPage Server Extensions 2002.
- FrontPage Server Extensions 2000: The patches can be
applied on the following systems running FrontPage Server Extensions
2000 - Windows XP Gold, Windows 2000, and NT4.
Inclusion in future service packs:
The fix for this issue will be included in Windows 2000 SP4,
Windows XP SP1 and any future service packs for FPSE 2002.
Reboot needed: Yes
Patch can be uninstalled:
- FrontPage Server Extensions 2000 patches on Windows 2000 and
Windows XP can be uninstalled.
- FrontPage Server Extensions 2000 patches for NT4 cannot be
uninstalled.
- FrontPage Server Extensions 2002 patches cannot be uninstalled.
Superseded patches: None.
Verifying patch installation:
- Users who are applying the patch on Windows 2000 or Windows XP
should refer to
Q324096
- Users who are applying the patch for FrontPage Server Extensions
2000 please refer to Knoweldege Base article
Q329085
- Users who are applying the patch for FrontPage Server Extensions
2002 please refer to Knoweldege Base article
Q329086
Caveats:
Users running FrontPage Server Extensions 2002 on any supported platform
who have not applied the latest update will need to apply the update
before installing this patch. To learn more about the update, please
read
Q317296. To go directly to the FrontPage Server Extensions 2002
Update, click
here.
Localization:
Localized versions of this patch are available at the locations
discussed in "Patch Availability".
Obtaining other security patches:
Patches for other security issues are available from the following
locations:
- Security patches are available from the
Microsoft Download Center, and can be most easily found by doing a
keyword search for "security_patch".
- Patches for consumer platforms are available from the WindowsUpdate web
site
