Title: FrontPage Server Extension Sub-Component Contains
Unchecked Buffer
Date: 21 June 2001
Software: Microsoft Visual Studio RAD Support in FrontPage
Server Extensions
Impact: Run code of attacker's choice
Bulletin: MS01-035

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-035.asp.

Issue:

FrontPage Server Extensions ship as part of IIS 4.0 and 5.0, and
facilitate the development of
Web sites and Web-based applications. FrontPage Server Extensions
includes an additional,
optional sub-component called Visual Studio RAD (Remote Application
Deployment) Support.
This sub-component allows Visual InterDev 6.0 users to register and
unregister COM objects on
an IIS 4.0 or 5.0 Server. This sub-component contains an unchecked
buffer in a section that
processes input information.
An attacker could exploit this vulnerability against any server with
this sub-component installed by
establishing a web session on with the server and passing a specially
malformed packet to the
server component. The attacker could use that packet to thereby load
code of his choice for
execution on the server. An attack that exploits this vulnerability
would execute in the
IUSR_machinename context (see Q142868). However, it is possible under
certain circumstances
to execute code in the SYSTEM context.

It is important to note that this feature is not installed by default
with FPSE. It is also not installed
by default on either of IIS 4.0 or 5.0. Also, when the feature is
selected during installation, a
warning message is raised alerting the administrator that this
feature should not be installed on
production machines, especially if the production machine has
Internet access. This is because
this feature is only intended for facilitating internal development.
The administrator must
acknowledge the warning to successfully install the feature.

Mitigating Factors:

• While FrontPage Server Extensions installs by default with IIS,
  Visual Studio RAD Deployment Support coordination is not
  provided with FPSE by default on an initial installation of
  IIS. Installation must be selected and approved by the user
  in charge of the server using the IIS setup process. If a user
  selects this sub-component during an initial installation, a
  warning is raised stating that this should not be installed
  on a production system. Users must actively acknowledge this
  warning to complete the installation.

Patch Availability:

• A patch is available to fix this vulnerability. Please read the
  Security Bulletin
  http://www.microsoft.com/technet/security/bulletin/ms01-035.asp
  for information on obtaining this patch.

Acknowledgment:

• Nsfocus (http://www.nsfocus.com)

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS
IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES,
EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT
CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER
INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF
BUSINESS
PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS
SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR
CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY
NOT
APPLY.