asp.net announcements: "Microsoft has posted guidance that protects against a reported
vulnerability in all versions of ASP.NET that could allow a Web site visitor
to view secured content by using specially crafted requests to a Web server.
"

Here's a suggested fix:

Global.asax code sample (Visual Basic .NET)
<script language="vb" runat="server">
Sub Application_BeginRequest(Sender as Object, E as EventArgs)
If (Request.Path.IndexOf(chr(92)) >= 0 OR _
System.IO.Path.GetFullPath(Request.PhysicalPath) <>
Request.PhysicalPath) then
Throw New HttpException(404, "Not Found")
End If
End Sub
</script>

Global.asax code sample ( C#)
<script language="C#" runat="server">
void Application_BeginRequest(object source, EventArgs e) {
if (Request.Path.IndexOf('\\') >= 0 ||
System.IO.Path.GetFullPath(Request.PhysicalPath) !=
Request.PhysicalPath) {
throw new HttpException(404, "not found");
}
}
</script>


For more information visit here.

http://www.microsoft.com/security/incident/aspnet.mspx

I've been installing this and testing the vpmodule.msi to prevent this issue
and have yet to see that it is adding the
'microsoft.web.validatepathmodule.dll' that it states should be in KB 887289.
The package is updating the machine.config, but not installing the dll. I've
been able to duplicate this on Win2k/IIS 5.0/.NET FW v1.1SP1 and
Win2003/IIS6/.NET FWv1.1 SP1. It states it installs successfully everytime
though.
Additionally, I've attempted to to manually update it per the KB and when
extracting the package, I get this Installer error:
Product: Microsoft ASP.NET ValidatePatch Module -- The installer has
encountered an unexpected error installing this package. This may indicate a
problem with this package. The error code is 2203. The arguments are
c:\temp\vpmodule.msi, -2147287008.

I've done a couple machines, and other than causing a conflict with
CAS in Reporting Services I have not had any problems. The module
installs and I can see the assembly in the GAC.

--
Scott
http://www.OdeToCode.com/

On Sat, 9 Oct 2004 15:03:08 -0700, "Geeb"
[quoted text, click to view]