Re: Unknown web log entry - new FrontPage exploit?

[TJ Jablonowski <t.jablonowski () MAIL-2-GO COM>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

If I remember correctly it is part of Office2K server extensions, an
subset of the FP Server extensions.  Don't have a machine to check
right now though so not sure. Could somebody be using a component
from it in their webpage???

- ----- Original Message -----
From: "Michael Katz" <mike () RESPONSIBLE COM>
To: <INCIDENTS () SECURITYFOCUS COM>
Sent: Thursday, December 21, 2000 16:44
Subject: Unknown web log entry - new FrontPage exploit?


> Hi all,
>
> Recently, I have noticed the following web log entry appearing 2-3
> times per day.
>
> GET /_vti_bin/owssvr.dll?UL=1&ACT=4&BUILD=2202&STRMVER=4&CAPREQ=0
>
> Based on the _vti_bin directory, I believe it's associated with
> FrontPage. When I tested the entry against a server using FrontPage
> extension, I receive the following message:

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0

iQA/AwUBOkMi22+7g8loOAk5EQKfhQCg12dZqBxHNni5Vpj3HZo6ugCprZsAn1fk
seLToWv48lT0Hvxg3dWJMhMj
=edLV
-----END PGP SIGNATURE-----