Four critical remote vulnerabilities, three of which are buffer overflows, have been discovered in Microsoft Commerce Server 2000 and 2002. All of these can lead to total system compromise by an attacker. Microsoft Site Server 3.0 and Microsoft Site Server 3.0 Commerce Edition are not affected. Bulletin MS02-033 has more information and a patch.