hva er dette ?

[minienthe]

MS05-004) ASP.NET Path Validation Vulnerability (887219)

Vulnerability Identifier: CAN-2004-0847

Discovery Date: Feb 8, 2005

Risk: Important

Vulnerability Assessment Pattern File: 023

Affected Software:

Microsoft .NET Framework 1.0

Microsoft .NET Framework 1.1

Description:

A canonicalization vulnerability exists in ASP.NET, which could allow a malicious user to access secure and protected files. The security mechanisms of an ASP.NET Web site can be bypassed to allow the malicious user unauthorized access.

Patch Information:

http://www.microsoft.com/technet/security/...n/MS05-004.mspx

Workaround Fixes:

Apply the mitigation code module discussed in Microsoft Knowledge Base Article 887289. The mitigation code module provides protection on a server-basis.

Make the following changes in the GLOBAL.ASAX file in the application root directory for each application on an affected system as an alternative to installing the module on a per-application basis:

<script runat=server language=cs>

void Application_BeginRequest(object src, EventArgs e)

{ if (Request.Path.IndexOf('\\') >= 0 || System.IO.Path.GetFullPath(Request.PhysicalPath) != Request.PhysicalPath) { throw new HttpException(404, "not found"); }}

</script>

Install and use URLScan to help protect systems against a large number of issues stemming from improperly formed URL requests, including the publicly described issues addressed by this bulletin. Note however that URLScan does not protect your system as comprehensively as either the mitigation code module or the GLOBAL.ASAX script.

More information on URLScan is available in the following page: http://www.microsoft.com/windows2000/downl...can/default.asp

fikk opp denne feilmeldingen etter et scan, noen som vet hva det kan være ?

[Gjest Gjest]

Det er en beskjed om at du har et sikkerhetshull i pc'n din som gjør at uvedkommende kan trenge seg inn på maskina di.

Gå inn på Microsoft sine hjemmesider og last ned de siste sikkerhetsoppdateringene derfra(bør gjøres jevnlig)

[minienthe]

sikkerhetsoppdateringer blir søkt etter hver natt klokka 3 og nødvendige oppdateringer innstallert, kan dette være et hull som trenger ekstra oppfølging på annen måte ?