Background: ASP.NET is a technology for developing dynamic web applications. It can run on Microsoft IIS web servers and supports several languages including Visual Basic .NET, C# and JScript .NET. ASP.NET allows administrators to restrict access to any directory by placing a web.config file in the directory. This causes the server to redirect visitors to an authentication page, where the visitor would be prompted to enter a password.
Critical Problem CVE: CVE-2004-0847
Impact: An attacker could gain unauthorized access to password-protected pages on the web server or create a cross-site scripting attack.
Programmatically Fix:
Global.asax code sample (Visual Basic .NET)
Sub Application_BeginRequest(Sender as Object, E as EventArgs)
If (Request.Path.IndexOf(chr(92)) >= 0 OR _
System.IO.Path.GetFullPath(Request.PhysicalPath) <> Request.PhysicalPath) then
Throw New HttpException(404, "Not Found")
End If
End Sub
Global.asax code sample (C#)
void Application_BeginRequest(object source, EventArgs e) {
if (Request.Path.IndexOf('\\') >= 0 ||
System.IO.Path.GetFullPath(Request.PhysicalPath) != Request.PhysicalPath) {
throw new HttpException(404, "not found");
}
}
source: http://support.microsoft.com/?kbid=887459
or via HTTP module: http://support.microsoft.com/?kbid=887289