Geeks With Blogs

News

  
Bill Evjen's Blog Code, Life and Community

No fix at the moment, but Microsoft reported an ASP.NET vulnerability yesterday:

http://www.microsoft.com/security/incident/aspnet.mspx

It deals with the canonicalization of files and a hacker's ability to play with the URL to get at files they shouldn't. There are safeguards to protect yourself in the meantime. Check out KB article 887459:

http://support.microsoft.com/?kbid=887459

Posted on Wednesday, October 6, 2004 8:34 AM ASP.NET , Microsoft | Back to top


Comments on this post: ASP.NET Vulnerability Reported - TAKE PROPER ACTION!

# MS KB 887459 : Work Around for the IIS5/ASP.NET Authentication Vulnerability
Requesting Gravatar...
The hills are alive with the sound of music KB links echoed through blogosphere. As reported here here here here here here here here here here (and too many other places to mention), MS has released a bulletin regarding this vulnerability. If you want to correct the problem, you should add the code from KB article 887459 to your Global.asax (or Global.asax.cs or Global.asax.vb, as the case may be). I still recommend using more fine-grained security checks on each page like I mentioned earlier and that you run URLScan and IISLockdown (if you can). Or upgrade to IIS 6. Better yet, do all of the above.
Left by Sirsha Development Resources Blo on Oct 06, 2004 12:35 PM

# MS KB 887459 : Work Around for the IIS5/ASP.NET Authentication Vulnerability
Requesting Gravatar...
The hills are alive with the sound of music KB links echoed through blogosphere. As reported here here here here here here here here here here (and too many other places to mention), MS has released a bulletin regarding this vulnerability. If you want to correct the problem, you should add the code from KB article 887459 to your Global.asax (or Global.asax.cs or Global.asax.vb, as the case may be). I still recommend using more fine-grained security checks on each page like I mentioned earlier
Left by Sirsha Development Resources Blo on Mar 12, 2005 5:40 PM

Your comment:
 (will show your gravatar)


Copyright © Bill Evjen | Powered by: GeeksWithBlogs.net