FP98: Browsing to ASP Files Through Shtml.dll Displays ASP Code

ID: Q182125

The information in this article applies to:

SYMPTOMS

Under certain conditions, an intruder knowledgeable in the architecture of the FrontPage Server Extensions may use his knowledge to gain access to the source code for Active Server Page files on an unprotected Web server. This is a security concern for those that have sensitive information in their ASP or Active Server Application (ASA) files.


RESOLUTION

To resolve this issue, you must install the updated version of the FrontPage Server Extensions. For more information about obtaining and installing the FrontPage Server Extensions, please see the following Microsoft Web site:

http://www.microsoft.com/frontpage/wpp/license.htm


STATUS

Microsoft has confirmed this to be a problem in the Microsoft products listed at the beginning of this article. This problem was corrected in version 3.0.2.1330 of the FrontPage Server Extensions.


MORE INFORMATION

The FrontPage Server Extensions, version 3.0.2.1330, check for either of the following in a page before processing it:

<%
If this value is found, Shtml.dll will not process any text until it comes across a %> value.
-or- 

&lt;SCRIPT RUNAT="server"
If this value is found, Shtml.dll will not process any text until it comes across a </script> value.

Alternatively, you can specify what file extensions Shtml.dll will evaluate. To do this, add the following line in the Frontpg.ini file
RunTimeFileExtensions=.ext1.ext2.
where .ext1 and .ext2 are the extensions you want Shtml.dll to evaluate. For example, if you want to process run-time FrontPage components on .htm and .html pages only, add the following line to the Frontpg.ini:
RunTimeFileExtensions=.htm.html

Additional query words: 98 security asp iis 


Keywords          : kbdta fpactive fpext 
Version           : WINDOWS:
Platform          : WINDOWS 
Issue type        : kbbug

Last Reviewed: July 8, 1999