ASP.Net vulnerabillity

From: Steve Shockley (steve.shockley_at_SHOCKLEY.NET)
Date: 10/06/04

  • Next message: Brian S. Bergin: "Re: Darn if you do Darn if you don't." 
    Date:         Wed, 6 Oct 2004 11:57:24 -0400
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    I got an email today about
    http://www.microsoft.com/security/incident/aspnet.mspx
    and
    http://support.microsoft.com/?kbid=887459

    The KB article implies that the problem is in applications, but the
    incident article implies that there's a vulnerability in ASP.Net. While
    adding checks to your web application certainly sounds like a Good Idea,
    I don't know if I'd consider that a solution to the problem or just a
    "best practice". (It also seems like IIS should handle that, especially
    if you have parent paths turned off.)

    Is any more information on this issue available? Are my IIS servers
    which have ASP.Net installed, but only have ASP or static HTML pages on
    the site, vulnerable? 

    --
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you'll have to copy their email address out of the message and place it in your TO: field.
--
  • Next message: Brian S. Bergin: "Re: Darn if you do Darn if you don't."