Microsoft Windows 2000 Patch: Malformed Hit-highli

When you conduct a search using Indexing Serice, the hit-highlighting function provides search results that highlight portions of documents that satisfy your search query. This vulnerability exists because Indexing Service doesnt set the correct parameters for hit-highlighting search requests. If a malicious user provides a specific type of malformed request, it retrieves files on the server, regardless of the permissions that have been set by the administrator.

By design, the hit-highlighting feature allows the user to specify the name of the document to be hit-highlighted. The user should only be able to request documents within the servers virtual directories; however, if a specific type of malformed argument is provided, it can be used to request a file by its physical location on the drive.