OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: MS Frontpage shtml.dll Path Leak Vulnerability
From: Marc (marcEEYE.COM)
Date: Tue Mar 14 2000 - 11:13:57 CST

Write an ISAPI filter that filters out the request or reroutes the user...
that should work.

Signed,
Marc
eEye Digital Security
http://www.eEye.com

"It is the years that blind you. Searching so hard for success you lose
grasp on the basic wonders of being alive."
-chameleon

| -----Original Message-----
| From: VULN-DEV List [mailto:VULN-DEVSECURITYFOCUS.COM]On Behalf Of Greg
| Sent: Sunday, March 12, 2000 9:51 PM
| To: VULN-DEVSECURITYFOCUS.COM
| Subject: MS Frontpage shtml.dll Path Leak Vulnerability
|
|
| Hi All
|
| This is my first time I have written to this forum so
| please excuse any annoying 'newbie' style message habits.
|
| I currently run NT4 Server with IIS4. I have discovered a
| hole where the actual path is produced on the web page if
| someone does the following provided the server running is
| NT4/IIS and have the FrontPage extensions installed:
|
| http://www.anydomainname.com/_vti_bin/shtml.dll/any_nonexist
| ent_web_page.htm
|
| Does anyone know of a fix available or a work around?
|
| I thank anyone who can help me out with this.
|
| Cheers ;-)
|
| - Greg
|