[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [Full-Disclosure] Frontpage Extensions Remote Command Execution

>>
Well, for one, it's not root level.  It allows ANONYMOUS (Guest) access
<<

No it's not, IWAM is Web Applications MANAGER account you were thinking of
IUSR perhaps? This is not guest. This account can change websites so in a
multi host environment this level of access will allow a compromise of every
website on the server.

Geo. (I'd call that root)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html