ASP.NET Vulnerability Reported - TAKE PROPER ACTION!

No fix at the moment, but Microsoft reported an ASP.NET vulnerability yesterday:

http://www.microsoft.com/security/incident/aspnet.mspx

It deals with the canonicalization of files and a hacker's ability to play with the URL to get at files they shouldn't. There are safeguards to protect yourself in the meantime. Check out KB article 887459:

http://support.microsoft.com/?kbid=887459

Wednesday, October 06, 2004 8:34 AM

Your Comments.

# MS KB 887459 : Work Around for the IIS5/ASP.NET Authentication Vulnerability

The hills are alive with the sound of music KB links echoed through blogosphere. As reported here here here here here here here here here here (and too many other places to mention), MS has released a bulletin regarding this vulnerability. If you want to correct the problem, you should add the code from KB article 887459 to your Global.asax (or Global.asax.cs or Global.asax.vb, as the case may be). I still recommend using more fine-grained security checks on each page like I mentioned earlier and that you run URLScan and IISLockdown (if you can). Or upgrade to IIS 6. Better yet, do all of the above.