Vulnerability Note VU#723537

Microsoft SmartHTML interpreter (shtml.dll) contains vulnerability

Quoting from MS02-053, "The SmartHTML interpreter, shtml.dll, is part of FPSE, and supports certain types of dynamic web content. For instance, using SmartHTML, a web developer can build a web page that relies on FrontPage features, but not actually have those features embedded within the page until a user requests it."

A remotely exploitable vulnerability in shtml.dll can allow a remote attacker to disrupt the normal operation of the web server or execute arbitrary code with system privileges. For more details, please see the "Impact" section of this document.

II. Impact

Systems Affected

http://www.microsoft.com/technet/security/bulletin/MS02-053.asp
http://lists.netsys.com/pipermail/full-disclosure/2002-September/002252.html
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnservext/html/fpovrw.asp

Credit

Maninder Bharadwaj of Digital Defense Services, part of Digital GlobalSoft Ltd., is credited with discovering this vulnerability.

This document was written by Ian A Finlay. It is based on information provided by Microsoft.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.