RE: Harden ASP.NET Configuration

From: Brian W. Spolarich (bspolarich_at_nephrostherapeutics.com)
Date: 05/13/03

  • Next message: Harbar, Spencer: "RE: Harden ASP.NET Configuration" 
    Date: Tue, 13 May 2003 10:34:22 -0400
To: ":: gary ::" <gary.bright@cisd.panasonic.co.uk>, <focus-ms@securityfocus.com>

    > [.net Application Mappings]
    >
    > .asax
    > .ascx
    > .ashx
    > .asmx
    > .aspx
    > .axd
    > .vsdisco
    > .rem
    > .soap
    > .config
    > .cs
    > .csproj
    > .vb
    > .vbproj
    > .webinfo
    > .licx
    > .resx
    > .resources

      Most of these application mappings return a response similar to "This type of page is not served", which is helpful in preventing folks from browsing the source files of your application, or the web.config file which might contain sensitive info like database connection strings and the like.

      I sympathize with and share the instinct towards having as little as possible marked as executable content by the web server. In this case it seems like asp_net.dll is doing the Right Thing.

      -bws

    -----------------------------------------------------------------------------
    FastTrain has your solution for a great CISSP Boot Camp. The industry`s most
    recognized corporate security certification track, provides a comprehensive
    prospectus based upon the core principle concepts of security. This ALL INCLUSIVE curriculum utilizes lectures, case studies and true hands-on utilization
    of pertinent security tools. For a limited time you can enter for a chance
    to win one of the latest technological innovations, the SEGWAY HT.
    Log onto http://www.securityfocus.com/FastTrain-focus-ms
    ------------------------------------------------------------------------------

  • Next message: Harbar, Spencer: "RE: Harden ASP.NET Configuration"

    Relevant Pages

    • [NT] Poisoning Cached HTTPS Documents in Internet Explorer
      ... Get your security news from a reliable source. ... "poison" a user's browser cache with a malicious document that will later ... The attacker can exploit this vulnerability for "replacing" HTML ... to communicate with a malicious web server over HTTPS without the browser ...
      (Securiteam)
    • [NT] Webserver 4D Weak Password Preservation Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... complete Web Server environment written entirely on top of 4th Dimension, ... WS4D web server saves the passwords somewhere insecure. ...
      (Securiteam)
    • Re: 2003 Web Server Security flaw
      ... "Locked-down windows 2003 Web Server used only to host web sites". ... What is your logic/rationale for Media Player being a required install ... The Media Player patch was the ONLY that FAILED. ... > When talking about computer security, there are areas that have no such ...
      (microsoft.public.windows.server.security)
    • Web session tracking security prob. Vulnerable: IIS and ColdFusion (maybe others)
      ... SECURITY PROBLEMS WITH WEB SERVERS' SESSION TRACKING MECHANISMS. ... 2001 we reported the following problem (with specifics to IIS and SITESERVER) to the Microsoft Security Response Center. ... These vulnerabilities, especially when combined with well-known cross-site scripting vulnerabilities, could cause loss of confidentiality, failure of non-repudiation and fraud. ... The browser stores and returns the "ASPSESSIONID" or "CFID/CFTOKEN" values with each subsequent request to the web server. ...
      (Vuln-Dev)
    • [NT] Easy File Sharing Web Server File Access and DoS
      ... Get your security news from a reliable source. ... Easy File Sharing Web Server also provides a Bulletin Board System ... It allows remote users to post messages and files to the forum. ...
      (Securiteam)