Title: Buffer Overrun in SmartHTML Interpreter Could Allow
Code Execution (Q324096)
Released: 25 September 2002
Software: FrontPage Server Extensions 2000 and 2002
Impact: Denial of service or privilege elevation
Max Risk: Critical
Bulletin: MS02-053
Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS02-053.asp.
The SmartHTML Interpreter (shtml.dll) is part of the FrontPage
Server Extensions (FPSE), and provides support for web forms and
other FrontPage-based dynamic content. The interpreter contains a
flaw that could be exposed when processing a request for a particular
type of web file, if the request had certain specific character-
istics. This flaw affects the two versions of FrontPage Server
Extensions differently. On FrontPage Server Extensions 2000, such
a request would cause the interpreter to consume most or all CPU
availability until the web service was restarted. An attacker could
use this vulnerability to conduct a denial of service attack against
an affected web server. On FrontPage Server Extensions 2002, the
same type of request could cause a buffer overrun, potentially
allowing an attacker to run code of his choice.
Microsoft thanks Maninder Bharadwaj ([email protected])
of Digital GlobalSoft Ltd. for reporting this issue to us and
working with us to protect customers.
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN
IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.