MS Frontpage Image Mapper Buffer Overflow Vulnerability
BID:1117
Info
MS Frontpage Image Mapper Buffer Overflow Vulnerability
| Bugtraq ID: | 1117 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2000-0256 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Apr 19 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | Posted to Bugtraq on April 19, 2000 by Narrow <[email protected]> of Legion 2000. |
| Vulnerable: |
Microsoft Personal Web Server 2.0 Microsoft NT Option Pack for NT 4.0 0 Microsoft FrontPage Personal WebServer 1.0 Microsoft FrontPage 98 Server Extensions for PWS Microsoft FrontPage 97 Server Extensions for PWS |
| Not Vulnerable: | |
Discussion
MS Frontpage Image Mapper Buffer Overflow Vulnerability
The htimage.exe and imagemap.exe files included with FrontPage handle server-side image mapping functions. Under normal operations, it would be passed a map name and a set of coordinates in the format http:&nbsp;//target/path/htimage.exe/mapname?x,y .
If the mapname portion of the request is replaced with 741 or more characters, the webserver software will crash, although the operating system will continue to function normally. Stack dumps reveal that user-supplied data occasionally makes it to the EIP register, making the execution of remote arbitrary code potentially possible.
The htimage.exe and imagemap.exe files included with FrontPage handle server-side image mapping functions. Under normal operations, it would be passed a map name and a set of coordinates in the format http:&nbsp;//target/path/htimage.exe/mapname?x,y .
If the mapname portion of the request is replaced with 741 or more characters, the webserver software will crash, although the operating system will continue to function normally. Stack dumps reveal that user-supplied data occasionally makes it to the EIP register, making the execution of remote arbitrary code potentially possible.
Exploit / POC
MS Frontpage Image Mapper Buffer Overflow Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue that run remote code. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
To crash the server:
http:&nbsp;//target/path/htimage.exe/<741+characters>?0,0
Currently the SecurityFocus staff are not aware of any exploits for this issue that run remote code. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
To crash the server:
http:&nbsp;//target/path/htimage.exe/<741+characters>?0,0
Solution / Fix
MS Frontpage Image Mapper Buffer Overflow Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
MS Frontpage Image Mapper Buffer Overflow Vulnerability
References:
References: