Microsoft FrontPage 2000 Server Extensions Security White Paper

---

Microsoft Corporation

July 29, 1999

This document presents the results of tests designed to evaluate the security controls for Microsoft® FrontPage® 2000 Server Extensions. The approach used to evaluate Microsoft FrontPage 2000 Server Extensions is discussed, and definitions of multiple test cases covering installation, configuration, penetration and data capturing are provided. The configuration of the testing laboratory and its equipment used to evaluate this product is described, and a security checklist and baseline security configuration are presented.

The Microsoft FrontPage Server Extensions are provided as a means to facilitate the rapid and easy development and administration of a potentially complex Web site. In the increasingly popular arena of Electronic Business and the Internet, this process is progressively more important. When connecting to the Internet, in any capacity, organizations and individuals assume significant security risk. When the focus of this connection is to conduct business, the risk is even greater. This white paper has been written to assist in enhancing the security controls surrounding the FrontPage Server Extensions and to help mitigate many of the common security issues that are introduced by engaging in remote administration of a web site on the Internet.

This document represents an attempt to accomplish the following:

• Provide an evaluation of the Microsoft FrontPage Server Extensions
• Provide information regarding the nature of risks and threats
• Uncover specific potential vulnerabilities within the product
• Recommended countermeasures for mitigating the risk of any exposure

This white paper should be used in conjunction with vendor literature, such as the Server Extensions Resource Kit (SERK) , and your own critical assessment, to determine its effectiveness and appropriateness for your business environment. This white paper is one of several sources that can be referenced when attempting to configure and assess a web server enabled with FrontPage Server Extensions.

Download details

Download the FPSEsecurity.exe (200K, self-extracting executable) and save to a location on your hard drive.

You may then extract the Microsoft Word document file by double clicking on the fp2kserk.exe and selecting a location to which you would like the file extracted.