Microsoft PWS could be exploited to remotely read arbitrary files
| pws-file-access (2036) |  Medium Risk |
Description:
A vulnerability in the file access protocols of the Microsoft Personal Web Server (PWS) and FrontPage PWS could allow arbitrary files to be remotely read. The attacker is required to have prior knowledge of file names to exploit this vulnerability, which does not yield any other privileges than read access.
Platforms Affected:
- Microsoft, Personal Web Server 4.0
- Microsoft, Personal Web Server
- Microsoft, Windows 2000
- Microsoft, Windows NT 4.0
Remedy:
Apply the Pwssecup.exe patch, as listed in Microsoft Security Bulletin MS99-010. See References.
Consequences:
File Manipulation
References:
- BugTraq Mailing List, 1996-01-17 20:30:13, Personal web server at http://marc.theaimsgroup.com/?l=bugtraq&m=91668256428214&w=2.
- BugTraq Mailing List, Tue Feb 15 2000 - 17:15:51 CST, Doubledot bug in FrontPage FrontPage Personal Web Server. at http://archives.neohapsis.com/archives/bugtraq/2000-02/0177.html.
- Microsoft Knowledge Base Article 216453, FP98: Security Patch for FrontPage Personal Web Server at http://support.microsoft.com/default.aspx?scid=kb;[LN];216453.
- Microsoft Knowledge Base Article 217763, File Access Vulnerability in Personal Web Server at http://support.microsoft.com/default.aspx?scid=kb;[LN];217763.
- Microsoft Knowledge Base Article 217765, FP97: Security Patch for FrontPage Personal Web Server at http://support.microsoft.com/default.aspx?scid=kb;[LN];217765.
- Microsoft Security Bulletin MS99-010, Patch Available for File Access Vulnerability in Personal Web Server at http://www.microsoft.com/technet/security/bulletin/ms99-010.mspx.
- BID-989: Microsoft FrontPage PWS Directory Traversal Vulnerability
- CVE-1999-0386: Microsoft Personal Web Server and FrontPage Personal Web Server in some Windows systems allows a remote attacker to read files on the server by using a nonstandard URL.
- CVE-2000-0153: FrontPage Personal Web Server (PWS) allows remote attackers to read files via a .... (dot dot) attack.
- OSVDB ID: 111: Microsoft Personal Web Server Arbitrary File Access
Reported:
Mar 26, 1999
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net