<< INETA just keeps growing | Home | MSN Maps and Directions >>

ASP.NET Vulnerability Reported - TAKE PROPER ACTION!

No fix at the moment, but Microsoft reported an ASP.NET vulnerability yesterday:

http://www.microsoft.com/security/incident/aspnet.mspx

It deals with the canonicalization of files and a hacker's ability to play with the URL to get at files they shouldn't. There are safeguards to protect yourself in the meantime. Check out KB article 887459:

http://support.microsoft.com/?kbid=887459

Print | posted on Wednesday, October 06, 2004 8:34 AM

Feedback

# MS KB 887459 : Work Around for the IIS5/ASP.NET Authentication Vulnerability

left by Sirsha Development Resources Blo at 10/6/2004 12:35 PM Gravatar
The hills are alive with the sound of music KB links echoed through blogosphere. As reported here here here here here here here here here here (and too many other places to mention), MS has released a bulletin regarding this vulnerability. If you want to correct the problem, you should add the code from KB article 887459 to your Global.asax (or Global.asax.cs or Global.asax.vb, as the case may be). I still recommend using more fine-grained security checks on each page like I mentioned earlier and that you run URLScan and IISLockdown (if you can). Or upgrade to IIS 6. Better yet, do all of the above.

# MS KB 887459 : Work Around for the IIS5/ASP.NET Authentication Vulnerability

left by Sirsha Development Resources Blo at 3/12/2005 5:40 PM Gravatar
The hills are alive with the sound of music KB links echoed through blogosphere. As reported here here here here here here here here here here (and too many other places to mention), MS has released a bulletin regarding this vulnerability. If you want to correct the problem, you should add the code from KB article 887459 to your Global.asax (or Global.asax.cs or Global.asax.vb, as the case may be). I still recommend using more fine-grained security checks on each page like I mentioned earlier
Post A Comment
Title:
Name:
Email:
Website:
Comment:
Verification:
 
 
Copyright © Bill Evjen