VULHUB ™

Microsoft Site Server is designed to run on Microsoft Windows NT Server platforms. It provides a means for users on a corporate intranet to share, publish, and find information. Site Server Commerce Edition incorporates the same features as well as providing an interface for e-commerce sites to interact and conduct business with customers and suppliers. Valid NT user accounts may use the module cphost.dll to upload content for Site Server 3.0. During this process, temporary files are created in the location C:\Temp, which is not configurable. If a malicious party uploads content with a TargetURL parameter of more than approximately 250 characters, the upload process will fail, and the temporary file will not be deleted. An authenticated attacker may exploit this to exhaust all drive space on C:, possibly leading to a denial of service condition.

Microsoft Site Server is designed to run on Microsoft Windows NT Server platforms. It provides a means for users on a corporate intranet to share, publish, and find information. Site Server Commerce Edition incorporates the same features as well as providing an interface for e-commerce sites to interact and conduct business with customers and suppliers. Valid NT user accounts may use the module cphost.dll to upload content for Site Server 3.0. During this process, temporary files are created in the location C:\Temp, which is not configurable. If a malicious party uploads content with a TargetURL parameter of more than approximately 250 characters, the upload process will fail, and the temporary file will not be deleted. An authenticated attacker may exploit this to exhaust all drive space on C:, possibly leading to a denial of service condition.