A trio of vulnerabilities in Microsoft's Content Management Server (MCMS) has come to light, the most serious of which potentially allows attackers to gain control of victim's machines. Microsoft has issued a patch - which Redmond characterises as of "critical importance" - designed to fix the problem with Content Management Server 2001 software, Redmond's product for the development and management of e-business Web sites.

First up, and most seriously, there's a buffer overrun flaw in a low-level function that performs user authentication in MCMS 2001. The result of exploiting this vulnerability would be to either cause MCMS to fail, or run code in the context of the MCMS service (which runs as Local System). Next there's a SQL injection vulnerability affecting a function that services requests for image files and other resources. Exploiting this flaw could enable an attacker to run SQL commands on the server, which would "not only allow data in the MCMS database to be added, changed or deleted, but would also enable the attacker to run operating system commands on the server," Microsoft admits.