Microsoft Patches ‘Critical’ Vulnerability

Microsoft Corp. on Thursday called a newly discovered vulnerability in its Content Management Server 2001 ‘critical’ and issued a patch that will correct it and two other vulnerabilities in the Web site building and maintenance product.

The company is recommending that administrators apply the patch immediately.

The worst vulnerability lies in the software’s user authentication function, according to Microsoft. At least one page included with the default Web server would allow a hacker to overrun the buffer, giving him control of the system the software is running on.

The scope of the vulnerability could be significantly reduced if the URL scan tool was deployed on the server. It is likely that in this case, the vulnerability could only be used for denial of service attacks.

The second vulnerability found in Content Management Server 2001 sits in the Web authoring feature. An attack could exploit the vulnerability to upload a program to the Web server and execute it. This wouldn’t give the attacker full control of the program, but it would give her a foothold to move forward from.

The third vulnerability lies in the software’s database feature, and allows an attacker to take any action on the database and run some operating system commands, as well. However, it would not give the attacker any administrative privileges on the server.