FrontPage Chicanery

[Brown, David S.]

You can also get some information here:

http://www.microsoft.com/technet/security/tools.asp

Specifically, there is a checklist for securing IIS 4.0 under NT 4.0 and IIS
5.0 under Windows 2000.  I have used them in the past, and they seemed
fairly good at the time.  They are also updated regularly.

Hope this helps...

-Dave
David Brown, Library Systems Manager
Mayo Medical Libraries, Rochester  MN
brown.davids at mayo.edu   (507) 284-2461

-----Original Message-----
From: Mark Pecaut [mailto:pecautm at missouri.edu]
Sent: Thursday, February 22, 2001 4:41 PM
To: Multiple recipients of list
Subject: [WEB4LIB] Re: FrontPage Chicanery


I don't use Frontpage, but they could be looking for frontpage 
vulnerabilites.  I don't know if they still do, but the 
frontpage `extensions' have a history of letting people 
overwrite passwords, or even run arbitrary commands on the 
webserver.  
It is explained better here:
http://www.insecure.org/sploits/Microsoft.frontpage.insecurities.html

Just a shot in the dark,
Oh, yes, and `vti' stands for `Vermeer Technology Inc'.
This is the company MS bought so they could have Frontpage.


On Thu, Feb 22, 2001 at 02:03:54PM -0800, Thomas Dowling wrote:
> Web4Lib--
> 
> Would someone who works with FrontPage 4 explain to me why copies of it
> from all over the world try to both GET and POST documents on my server in
> various "/_vti_" files or directories?
> 
> And has anyone ever taken a 10GB core file, named it "_vti_inf.html" and
> given such FP'ers what they deserve?  [fx: Dowling's evil chortle]

I haven't, but it sounds like fun!
 
> 
> Thomas Dowling
> OhioLINK - Ohio Library and Information Network
> tdowling at ohiolink.edu

-Mark