Rule:--Sid:943--Summary:This event is generated when an attempt is made to exploit a known vulnerability in a web server running Microsoft FrontPageServer Extensions.--Impact:Information gathering and system integrity compromise. Possible unauthorizedadministrative access to the server or application. Possible executionof arbitrary code of the attackers choosing in some cases. Denial ofService is possible.--Detailed Information:This event is generated when an attempt is made to compromise a hostrunning Microsoft FrontPage Server Extensions. Many knownvulnerabilities exist for this platform and the attack scenarios arelegion.In this case an attempt is being made to access the executable filefpsvradm.exe from resources external to the protected network.--Affected Systems:	All systems running Microsoft FrontPage Server Extensions--Attack Scenarios:Many attack vectors are possible from simple directory traversal toexploitation of buffer overflow conditions.--Ease of Attack:Simple. Many exploits exist.--False Positives:None known.--False Negatives:None known.--Corrective Action:Ensure the system is using an up to date version of the software and hashad all vendor supplied patches applied.--Contributors:Sourcefire Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:Microsoft:http://www.microsoft.com/resources/documentation/office/2000/all/reskit/en-us/75t4_3.mspx--