|
Microsoft has released patches, KB924430 for 2001 SP1 and KB924429 for 2002 SP2, to address this vulnerability. It is also possible to correct the flaw by implementing the following workaround:
Setting an MCMS site to Yes-Read Only will disable content authoring and access to that MCMS server entry point from Site Manager
Setting an MCMS site to Yes-Read Only will disable content authoring and access to that MCMS server entry point from Site Manager, but doesn't remove any files from the file system. If you want to use the Site Manager tool to modify settings on a read-only MCMS site, you must first make the site read-write in the Web Server Configuration tool.
Setting an MCMS site to read-only means that you can't use the client-side SDAPI (or Site Manager) to deploy content. On a read-only site, you must use the server-side SDAPI for content deployment API unless you have a separate read-write Web entry point.
To modify the MCMS site to YES-Read Only, follow these steps:
1. Click Start, click Programs, and then select Microsoft Content Management Server.
2. Click Server Configuration Application.
3. Click the Web tab and then select Configure.
4. In the dialog box for the MCMS Web site you wish to configure, select Yes - Read Only.
5. Click OK to save the changes.
Impact of Workaround: Users will no longer be able to author content via MCMS Web Author (you cannot login with edit rights on an MCMS Server) nor via Site Manager.
|
