RE: Frontpage Extensions Remote Command Execution

["Geo." <geoincidents () getinfo org>]

> >
Well, for one, it's not root level.  It allows ANONYMOUS (Guest) access
<<

No it's not, IWAM is Web Applications MANAGER account you were thinking of
IUSR perhaps? This is not guest. This account can change websites so in a
multi host environment this level of access will allow a compromise of every
website on the server.

Geo. (I'd call that root)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html