Has anyone even had any luck reproducing this? I can't for the life of
me get a crash...
-----Original Message-----
From: Geo.
Sent: Wed 11/12/2003 11:41 AM
To: full-disclosure@lists.netsys.com
Cc:
Subject: RE: [Full-Disclosure] Frontpage Extensions Remote
Command Execution
>>
Well, for one, it's not root level. It allows ANONYMOUS (Guest)
access
<<
No it's not, IWAM is Web Applications MANAGER account you were
thinking of
IUSR perhaps? This is not guest. This account can change
websites so in a
multi host environment this level of access will allow a
compromise of every
website on the server.
Geo. (I'd call that root)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
<<winmail.dat>>