Microsoft Frontpage Server Extensions Path Disclosure Vulnerability

Bugtraq ID:	1174
Class:	Design Error
CVE:	CVE-2000-0413
Remote:	Yes
Local:	Yes
Published:	May 06 2000 12:00AM
Updated:	Jul 11 2009 01:56AM
Credit:	Posted to Bugtraq on May 6, 2000 by Frankie Zie <[email protected]>.
Vulnerable:	Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack Microsoft FrontPage Server Extensions Module for Apache 3.0.4 Microsoft FrontPage 2000 Server Extensions SR 1.0 + Microsoft FrontPage 2000
Not Vulnerable:	Microsoft FrontPage 2000 Server Extensions SR 1.2 + Microsoft FrontPage 2000

Microsoft Frontpage Server Extensions Path Disclosure Vulnerability

The local path of a HTML, HTM, ASP, or SHTML file can be disclosed in Microsoft IIS 4.0/5.0 / Frontpage Server Extensions 1.1 and prior. Passing a path to a non-existent file to the shtml.exe or shtml.dll (depending on platform) program will display an error message stating that the file cannot be found accompanied by the full local path to the web root. For example, performing a request for http://target/_vti_bin/shtml.dll/non_existant_file.html will produce an error message stating "Cannot open "C:\localpath\non_existant_file.html": no such file or folder"

Microsoft Frontpage Server Extensions Path Disclosure Vulnerability

http://target/_vti_bin/shtml.exe/non-existent-file.html
http://target/_vti_bin/shtml.exe/non-existent-file.htm
http://target/_vti_bin/shtml.exe/non-existent-file.shtml
http://target/_vti_bin/shtml.exe/non-existent-file.asp
http://target/_vti_bin/shtml.dll/non_existant_file.html

Microsoft Frontpage Server Extensions Path Disclosure Vulnerability

Solution:
This issue has been addressed in Microsoft FrontPage Server Extensions SR1.2:


Microsoft FrontPage 2000 Server Extensions SR 1.0

• Microsoft FrontPage Server Extensions SR2
  http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnser vext/html/SR12.asp

Microsoft IIS 4.0

• Microsoft FrontPage Server Extensions SR2
  http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnser vext/html/SR12.asp

Microsoft IIS 5.0

• Microsoft FrontPage Server Extensions SR2
  http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnser vext/html/SR12.asp

Microsoft FrontPage Server Extensions Module for Apache 3.0.4

• Microsoft FrontPage Server Extensions SR2
  http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnser vext/html/SR12.asp

Microsoft Frontpage Server Extensions Path Disclosure Vulnerability

References: