ASP.NET security vulnerability

[NC Software]

For your AC SEO BLOG and RSS FEED (suggested):

http://weblogs.asp.net/scottgu/archive/ ... ility.aspx

[jmestep]

Rats! Neal, I thought I beat you to something for a change.
http://www.microsoft.com/technet/securi ... 16728.mspx

[Logan Rhodehamel]

AC will be OK if you comment out the custom 404 line in our default web.config file. Other than that it's using the same redirect for all errors.

Code: Select all

		<customErrors mode="On" defaultRedirect="~/Errors/GeneralError.aspx">
			<error statusCode="404" redirect="~/Errors/PageNotFound.aspx" />
		</customErrors>

Should become:

Code: Select all

		<customErrors mode="On" defaultRedirect="~/Errors/GeneralError.aspx">
			<!-- <error statusCode="404" redirect="~/Errors/PageNotFound.aspx" /> -->
		</customErrors>

At least until Microsoft fixes the problem.

[vn2479]

Wow. I just downloaded the latest version of AC. Do I need to worry about this? Do I need to make the code change in my web.config file? I'm still learning web security. Much thanks!

[NC Software]

Microsoft is releasing a fix later today (9/28). All should do Windows Updates on your servers, etc. to install this security patch when released by Microsoft.

[NC Software]

http://www.microsoft.com/downloads/en/d ... dc720908f6

[NC Software]

The security fixes are NOW available via Windows Update. Be sure to update ASAP!