Microsoft Windows NT 4.0 Patch: Malformed Hit-highlightingWindows NT update. | |
Download |
Microsoft Windows NT 4.0 Patch: Malformed Hit-highlighting Ranking & Summary
Advertisement
- License:
- Update
- Publisher Name:
- Microsoft
- Publisher web site:
- http://www.microsoft.com/
- Operating Systems:
- Windows 98, Windows 2000, Windows XP
- File Size:
- 100.59K
Microsoft Windows NT 4.0 Patch: Malformed Hit-highlighting Tags
Microsoft Windows NT 4.0 Patch: Malformed Hit-highlighting Description
From Microsoft: This update addresses the "Malformed Hit-Highlighting" security vulnerability in Windows NT® 4.0 computers running Index Server 2.0, and is discussed in Microsoft Security Bulletin MS01-025. Download now to prevent a malicious user from reading files on your Web server. When you conduct a search using Indexing Server 2.0, the hit-highlighting function provides search results that highlight portions of documents that satisfy your search query. This vulnerability exists because Indexing Server 2.0 doesn't set the correct parameters for hit-highlighting search requests. If a malicious user provides a specific type of malformed request, it retrieves files on the server, regardless of the permissions that have been set by the administrator. By design, the hit-highlighting feature allows the user to specify the name of the document to be hit-highlighted. The user should only be able to request documents within the server's virtual directories; however, if a specific type of malformed argument is provided, it can be used to request a file by its physical location on the drive. For more information about this vulnerability, read Microsoft Security Bulletin MS01-025.
Microsoft Windows NT 4.0 Patch: Malformed Hit-highlighting Related Software