Microsoft Issues Ominous ASP.Net Security Warning

An anonymous reader writes "A security flaw in Microsoft's ASP.NET apparently allows access to password-protected areas just by altering a URL. There's no patch yet, but in the meantime Microsoft is telling ASP.NET developers they can rewrite their applications to prevent exploits. About 2.9 million web sites run on ASP.NET according to Netcraft." Some more links: another Microsoft article, NTBugtraq, K-Otik and Heise.

Comments

How Dogbert would handle this

[mfh]

There's no patch yet, but in the meantime Microsoft is telling ASP.NET developers they can rewrite their applications to prevent exploits.

And that's why Microsoft is going to eventually lose the war against open source. Can you imagine the heated boardroom discussions going around the table now?

Dilbert: "Microsoft says we need to pull 20 programmers away from their current workloads to focus on fixing ASP .NET in all our websites. C-c-canon-ical-ization is what they are calling it."

Dogbert: "How long is this going to take? And who is making these words up anyway?"

Dilbert: "Two weeks." (I mean that's the standard response right?)

Dogbert: "Let's give all our programmers a holiday, effective yesterday. Shut the sites down in twenty minutes after I call our contact in Belize. It's time for EULA loophole #27. {{WAG!}}"

So do the math. And tell me, please, all ye Microsoft supporters, why Open Source lowers my ROI again!

Re:How Dogbert would handle this

[nizo]

Microsoft is telling ASP.NET developers they can rewrite their applications to prevent exploits.

My first thought was, "yes, rewrite them in perl or PHP".

Re:How Dogbert would handle this

[Anonymous Coward]

Microsoft says we need to pull 20 programmers away from their current workloads to focus on fixing ASP .NET in all our websites.

No, they say you have to copy/paste a few lines of code into your primary web assembly. That's one programmer for a few hours if you take into account testing and deployment.

Re:How Dogbert would handle this

[Timesprout]

While I think the flaw itself is a concern the 'rewrite their applications' quote is pure drivel. All thats required is a couple of lines in Global.asax. Thats hadly a rewrite.

Re:How Dogbert would handle this

[Gentoo Fan]

It sounds better to yell "rewrite!" for the knee-jerk Slashbots rather than "five line patch!"

Re:How Dogbert would handle this

[mirko]

What about Red HAt, SuSe and others who may distribute Open Source program while being accountable according to your definition ?

Re:How Dogbert would handle this

[Saeed al-Sahaf]

There's no patch yet, but in the meantime Microsoft is telling ASP.NET developers they can rewrite their applications to prevent exploits.

And that's why Microsoft is going to eventually lose the war against open source. Can you imagine the heated boardroom discussions going around the table now?

Unfortunately, no this probably will not happen (this way). The PHBs will simply say to the IT department: "We have a Support Agreement, right? Good. Get on it!" And, unless someone actually compromises the system, all will be forgotten. Even then, at most the typical boardroom response will be "damn Linux using Dirty Hippies (tm)."

The problem is, you assume that the corporate top layer cares about the details of implementation, when in fact, their world is a world of charts and graphs and executive summaries that don't hit these kinds of points.

Re:How Dogbert would handle this

[pbranes]

Netcraft confirms it - asp.net is dying. Thank you, thank you. I'll be here all week.

Seriously, what kind of nonsensical idea is it for programmers to rewrite their programs to work around a security hole in the **compiler**??!! That's just ridiculous. Microsoft needs to have the patch out front & center right now.

Re:How Dogbert would handle this

[Aumaden]

Tell that to the Enron shareholders!

Re:How Dogbert would handle this

[ThePatrioticFuck]

"All thats required is a couple of lines in Global.asax. Thats hadly a rewrite."

No no no, I'm afraid we can't allow that. This is a MS bashing story, you can only submit such insightful and logical suggestions on *Nix flaw stories :)

Re:How Dogbert would handle this

[hruntrung]

You know, even "5 line patch" says to me "We got bitten in the ass by a bug we've been bitten in the ass by numerous times in the past, and our core web framework is affected."

It's not the first time they've had a cannonicalization issue. It greatly diminishes my confidence in their product, if only because this indicates they didn't think to focus testing on an area which has presented security issues for them in the past.

Yes, the fix is small; the point would be, however you feel religiously about .NET and the company that produces it, that the flaw should never have been there. They should have worked to cover their flank in a previously sensitive area. That they havent indicates that their new focus on Trustworthy Computing is largely meaningless.

Re:How Dogbert would handle this

[badriram]

Comparing PHP 4.3.x series to ASP.NET (both 1 and 1.1) at secunia. It seems to me that the vulnerabilities are 10 to 3. If you were recommending a product, at least do some research before you do.

Re:How Dogbert would handle this

[orasio]

A couple lines in Global.asax.
If you don't do any funny things with Global.asax.
Plus testing. Plus deployment.
3 hours

Times all affected sites.

A patch would take less time, surely.
Of course, it's nice to have a workaround when you don't have a patch, anyway.

Using a java application server could take much longer, but it should pay in the end:)

Re:How Dogbert would handle this

[Gentoo Fan]

I'm not defending Microsoft, I'm simply saying that the actual fix for the problem isn't what the Slashdot write-up implies ("rewrite their applications"). Adding a few lines in Global.asx is NOT a "rewrite".

Re:How Dogbert would handle this

[gclef]

Ummm...read the guide carefully...looks to me like the five lines are just a hook to "convenient location to insert code to help safeguard against canonicalization issues." The five lines that they tell you to insert don't actually do the canonicalization for you, just give you a consistent hook for that code for all your apps.

Re:How Dogbert would handle this

[deadlinegrunt]

Rewrite - yes; too extreme
"five line patch" - too simple

There are companies that have to research, document, code, document, test, document, release from development to production, document, etc...

A better description lies somewhere between "rewrite" and "five line patch". Proprietary or OSS will have bugs; this release cycle still has to be done if it is a "rewrite" or a "patch".

Just something to think about.

Re:How Dogbert would handle this

[gclef]

Never mind. I'm an idiot. Just re-read the guide...they include the code.

Re: How Dogbert would handle this

[Black Parrot]

> While I think the flaw itself is a concern the 'rewrite their applications' quote is pure drivel. All thats required is a couple of lines in Global.asax. Thats hadly a rewrite.

Since it's trivial, can I expect Microsoft to send someone by to do it for us?

Re:How Dogbert would handle this

[Gentoo Fan]

It's not even an "application" update anyways, it's just a configuration method for the webserver itself. Sure, there will have to be testing and documenting involved, but given that this is really just a configuration issue I don't see it as much more than a "patch".

Re:How Dogbert would handle this

[coolgeek]

I believe the difference is the PHP leaks have been resolved.

Re:How Dogbert would handle this

[jsin]

This was much easier to fix than the GRUB/Fedora Core 2 multiboot bug...

For those who are interested, the fix is here:

http://support.microsoft.com/?kbid=887459

For those about to rock, we salute you.

Re:How Dogbert would handle this

[Crashman_pnc]

There are companies that have to research, document, code, document, test, document, release from development to production, document, etc...

A better description lies somewhere between "rewrite" and "five line patch". Proprietary or OSS will have bugs; this release cycle still has to be done if it is a "rewrite" or a "patch".

I would hope that any company that has a formal release cycle in place would have taken one look at this form of authentication and dismissed it just like most other ASP.NET programmers have.

When I first saw the web.config security I thought to myself, so what I'm still going to have to write a security system on top of this because it doesn't do jack.

I'm not worried about this with any of my sites. You may be able to get to a file in the admin section but you are still going to fail the test that runs inside the code. All the web.config did was stop you before it got to that check. I may program with microsoft tool but I don't trust them to do my security work for me.

Re:How Dogbert would handle this

[Spoing]

A slight re-write;

1. Dilbert: "Microsoft says we need to pull 20 programmers away from their current workloads to focus on fixing ASP .NET in all our websites. C-c-canon-ical-ization [reference.com] is what they are calling it."

Dogbert: "With so many companies using ASP .NET, it's unlikely that we will be singled out for attack. Besides, if our admins aren't fighting fires, how do we know that they are doing a good job or not?"

Re:How Dogbert would handle this

[sn0wflake]

It's funny how the slashdot crow jumps in with witty comments when the story is about Microsoft. Whenever it FOSS related it's always serious and informative. Every application has errors one time or another. Slashdot is biased I'm sorry to conclude.

Re:How Dogbert would handle this

[hruntrung]

Kindly pay attention if you're going to comment. The post answers this "point" fairly simply. Yes, software has flaws. However, if you've encountered a flaw in the software you produce in the past, it makes sense to note that fact and pay special attention to it.

Microsoft has had issues with cannonicalization in the past, several times. Given that history, it speaks poorly of their development practices that they've once again produced a product with the same flaw as before.

By way of analogy, lets say you have an issue with the widget you make - when left near open flame, it explodes. Now, being that your product is generally used in fireplaces, this is something of a problem. After several incidents where this problem crops up, you finally manage to provide a doodad for your widget that prevents the explosion issue. Good. Now, you've created and are marketing your spiffy new super-mega-ultra-widget. In preparing to release the product, might it not make sense to make sure that it doesn't explode when left near open flame?

Re:How Dogbert would handle this

[Anonymous Coward]

The "Rewrite of the application" is about 3 lines of code being inserted into a single event handler for each application. Let's not jump on the "Microsoft BAD, Open source GOOD" band wagon before we know our facts. It's not a "rewrite" of the application, just an update.

Re:How Dogbert would handle this

[jafomatic]

This sounds more like the product of 3 lines of code and 2.9 million updates, so let's not jump on the "Microsoft not so BAD" bandwagon either.

Maybe we should stay away from bandwagons entirely? :)

Re:How Dogbert would handle this

[legirons]

"It sounds better to yell "rewrite!" for the knee-jerk Slashbots rather than "five line patch!""

Howabout "your applications have been vulnerable for years, and you only just found out"?

Hope there wasn't any important data on those websites. How sure are you that it's still correct?

Re:How Dogbert would handle this

[LnxAddct]

Thats why I use Tomcat :) Java is a wonderful thing.
Regards,
Steve

Re:How Dogbert would handle this

[Ingolfke]

Do the ASP.NET flaws require re-writing your application server to work around them?

Re:How Dogbert would handle this

[Not_Wiggins]

I'm no fan of Microsoft, but as a software developer who has worked with overloaded QA folk, it doesn't surprise me that bugs like this slip through the cracks.

I agree with your assessment of the "5 line patch/ass biting" part, but I wouldn't let something like this diminish your confidence in their product; this really is a normal BAU type of bug.

Now, if you'd rather their business practices and attempts to take open standards, close-source them, and try to use their monopolies to cram them down your throat to extend into further monopolies guide your judgement about their products, then I'd say you're on the right track. ;)

Re:How Dogbert would handle this

[ceswiedler]

Clearly you don't have much experience with the sort of systems where absolutely nothing takes a 'few hours' of testing.

Re:How Dogbert would handle this

[foobsr]

The problem is, you assume that the corporate top layer cares about the details of implementation, when in fact, their world is a world of charts and graphs and executive summaries that don't hit these kinds of points.

Yes. While discussing the charts to be produced for the board of a not so small company carrying the mnemonic of a (famous) line of English sports cars as a part of its name with an assistant to a board member: "And please do the charts as uncomplicated as possible for the gentlemen to understand". Hard to imagine those can even get close to the point where one may eventually consider implications of different ways to implement (whatever has to be implemented).

CC.

Re:How Dogbert would handle this

[jd]

Hmmm. Depends. Not all code is what I would call "well-written", with a 1:1 mapping between tasks and functions. It's not unusual for coders to cut-and-paste routines, where some slight variation is needed, but it'd be easier to have a copy of a routine than have a common, generic function. In the "worst case" scenarios, you'll see different coders actualy re-write the same routines in different places.

For passwords, you might easily have different password routines for different roles. One for general users, one for admins, etc. Each of these different routines would need to have these five lines written. Changing only one wouldn't fix the hole in any of the others.

A large application, though, might easily have hundreds of thousands of lines of code. They may be split into hundreds of thousands of web pages, but that doesn't make it any easier to search through.

Also, coders aren't always the best at documenting what they're doing. This means that, in order to make sure you've fixed all password entry points correctly, you've got to do some fairly extensive code checking.

Now, I'll agree that in "reasonable" cases, 5 lines isn't much. Especially compared to the length of a typical application (even a web-based application). In such cases, it'll take you maybe a minute to locate the right point, a minute to make the changes, and a third minute to verify the code works correctly.

In "unreasonable" cases (and I've seen plenty), you're looking at writing a script to search for code that may be password-related, manually checking those routines, adding the code, manually investigating the path necessary to reach that point in the program, and THEN checking to see if the new code works correctly. This is going to take a lot longer.

In the "worst case" scenarios, you've multiple versions of a routine, and no documentation as to where they are or what they look like. In these cases, you've got to manually search the code, because you've nothing to base an automated search on.

True, you could still argue that it's not "rewriting the code". Technically, it isn't. What it is, though, is potentially very expensive and time-consuming, with an element of risk that entry points will be missed. The larger the organization, the more likely that hazardous redundancy exists, or shortcuts were taken. And it's generally the larger organizations that are most likely to be at risk. Even if the phrasing is not "technically" correct, I can certainly understand the spirit and intent of the story poster.

Re:How Dogbert would handle this

[Anonymous Coward]

The difference being that one I payed for and expect support, the other I didn't and expect to provide my own support. If I were an asp.net customer I would seriously write Microsoft for a refund, they aren't doing what they agreed to do in a contract. Telling you to do *anything* to fix a product that is flawed because they did something wrong is just ridiculous. If a car has a screw that becomes loose after 10,000 miles and could potentially let the engine drop out, regardless of how rare it might happen, every car will be recalled and the screw will be tightened and the car given back. Do you really think that a car company would tell its customers to tighten the screw? Why should microsoft tell its customers to fix something? That shouldn't be expected. I'm not saying that you have to go the free road with open source, I'm saying that I wouldn't trust my company with Microsoft and like an above poster stated, go with Java. If you don't need support then java and/or php will work fine. If you do need support, at least I know SUN won't jerk me around like the MS crap.

Re:How Dogbert would handle this

[fitten]

Hi...

Microsoft didn't say they would "never fix it". They said that a patch isn't yet available and here is a workaround (like that's never happened in F/OSS before...) until a patch is ready. In any case, it isn't rewriting your whole application and the fix is pretty easy and even after a patch is provided, the "work around code" will still work fine and have correct behavior.

Geesh... some folks will jump onto any bandwagon that comes down the street.

Re:How Dogbert would handle this

[Anarchofascist]

Problems with PHP, as with almost all security issues in all software, can be fixed with a patch to the execution environment. The difference here is that the reccomended fix is to patch everybody else's code.

Re:How Dogbert would handle this

[Anonymous Coward]

Yeah... nothing like you describe ever happens in F/OSS.

Re:How Dogbert would handle this

[Alan]

If you're referring to some of the 'check for backspace at end of url' code that's been thrown out there, there is more than three lines, as you also would have to check for various forms of URI encoding as well.

Of course, that's just a bandaid to the problem, the solution is to fix the underlying code, which should have been fixed years ago.

Apparently this is fixed in IIS6 and w2k3, and that's what various users I've seen are recommending, but 'upgrade your server' is simply not a good solution (though a standard MS one).

Re:How Dogbert would handle this

[Knightmare]

Yep.... sure is a huge fix too, it would probably take days to retrofit your applications. Or just put the following code in Global.asax:

<script language="C#" runat="server">
void Application_BeginRequest(object source, EventArgs e) {
if (Request.Path.IndexOf('\\') >= 0 ||
System.IO.Path.GetFullPath(Request.PhysicalPath) != Request.PhysicalPath) {
throw new HttpException(404, "not found");
}
}
</script>

P.S. - I am not a microsoft supporter, I am a security guy by profession, and they have caused numerous headaches for me. But this doomsday talk is just silly. Do we need to stop and enumerate the vulns that have been seen in open source alternatives? How about back when php didn't make you distinguish between user variables and server side variables, ya that was secure. And if you tried to look up info on any of the frameworks that are within light years of asp.net (good luck finding them) you would find vulns in them as well. ASP.NET so far has fared really well, do I think this is an amature mistake to miss, yes, do I think it's as dramatic as you make it out to be, no.

Re:How Dogbert would handle this

[flacco]

"Think not that I am come to send peace on earth: I came not to send peace, but a sword." -- Mathew 10:34

what the heck is that supposed to mean?

damn savages.

Re:How Dogbert would handle this

[harrsk]

Drivel!? Here at /. we know that when defect != MS based, it's much much easier to fix! I'm sure workarounds and patches would have been developed and implemented by legions of Open Source Angels shooting laser beams from their eyeballs at the affected non-MS web servers by now. Didn't you know that non-MS bug fixes are FREE to implement!?

Re:How Dogbert would handle this

[hruntrung]

Ok, let's review:

1) Microsoft has had numerous cannonicalization issues in the past

2) Microsoft has a Trusted Computing focus now, the ostensible purpose of which is to make their products more secure

3) Given 1) and 2), Microsoft should have concentrated extra testing in the specific area in which this bug occurs.

Point 3 is derived from a principle called learning from one's mistakes. If you repeatedly screw up something, and want to stop screwing it up, you look at what you screwed up and work extra hard to prevent that.

Re:How Dogbert would handle this

[badriram]

you did read the pages i linked didnt you. cause if you did you would notice a similar vulnerability on there that has not been fixed.

Re:How Dogbert would handle this

[Eraser_]

So all you do is append ::$data to the end of your URL and it bypasses the ASP processor? Oh sorry, wrong year. / for \? So Unix is the cause of Microsofts demise. Of course it's their own fault for not just using / because they have to be different.

Re:How Dogbert would handle this

[phobonetik]

At a glance, I cannot see the Caconicalisation bug the main article mentions, in this secuna report. Assuming the volumne of bugs "is correct", you need to take into account; - the criticality and impact of the bugs - the turn-around time for resolution It news to no-one that open source software consistantly is open to discovery of DoS, buffer-overrun and other exploits, however its common place to expect that where bugs are critical and have a major forseen repercussion, they are resolved very quickly, with patches available and encouragement to upgrade advertised in numerous popular internet locations. On the other hand, vendors have a much harder time tracking down such problems, and/or issueing statements, which could well be the reason for ASP's low volume of bugs.

Re:How Dogbert would handle this

[Pieroxy]

If a car has a screw that becomes loose after 10,000 miles and could potentially let the engine drop out, regardless of how rare it might happen, every car will be recalled and the scre will be tightened and the car given back

You seem to have a rather short memory. 3 years ago, Ford execs knew that the tires they equipped all their Explorer SUVs was defective and could explode when too hot on a highway, effectively killing all its occupants. Lots and lots of emails proved it. Firestone execs knew was well. A lot of people died. Yet, it had to go public through a third-party (a private investigation by a journalist IIRC). Then, they recalled.

In that regard, we can safely say that Microsoft is more fair play than Ford is. And no,I don't think Ford is any exception.

Re:How Dogbert would handle this

[FyRE666]

If a car has a screw that becomes loose after 10,000 miles and could potentially let the engine drop out, regardless of how rare it might happen, every car will be recalled and the screw will be tightened and the car given back. Do you really think that a car company would tell its customers to tighten the screw?

Cue: Dialogue from "Fight Club"

Narrator: A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one.

Business woman on plane: Are there a lot of these kinds of accidents?

Narrator: You wouldn't believe.

Business woman on plane: Which car company do you work for?

Narrator: A major one."

Re:How Dogbert would handle this

[smileyy]

Except for those things known as Negligent Homicide and its kin...

Re:How Dogbert would handle this

[danheskett]

But isn't your whole point, given what you've detailed, oblierated by the fact that this vulnerability does not exisit on Win2k3 with IIS6?

I mean, MS's product that was released after the Trusted Computing initiative does not have this flaw.

It certainly seems like your point is negated.

Re:How Dogbert would handle this

[alph0ns3]

If you are to compare products, why don't you compare the latest versions of both?

Re:How Dogbert would handle this

[sosume]

"five line patch" - too simple
Especially if the fix contains the line:

throw new HttpException(404, "not found");

Re:How Dogbert would handle this

[ReelOddeeo]

>>"Think not that I am come to send peace on earth: I came not to send peace, but a sword." -- Mathew 10:34

>what the heck is that supposed to mean?

If you look at the context, versus 34 through, say, about 37, you can see exactly what it means.

Jesus didn't come to bring unity, but to bring division. He goes on to detail that division, between husband and wife, division between families, etc. Then in v.37 it is clear that the meaning is that He calls you to serve Him. That is the division. Some will, and some won't. There will be division between those who choose to believe and those who will never believe. Even within families.

On my reading of it, that appears to be the plain simple intended meaning.

Re:How Dogbert would handle this

[kumachan]

There is an issue of maintainability here though. Will there be a patch, or will MS believe they have fixed it by telling everyone to just use this piece of code? I wouldn't want to have to rememeber to add this code everytime I write a webapp in the future - forgetting to add it in 1 year's time and getting bitten. Code re-use or in this case copy+pasting code isn't a nice idea either. One alteration here for a special case and you might end up copying it into multiple applications. Does it interefere with current apps that need or use a \ in their path? Websites now might have this code added which will live there for the rest of their lives, even after a patch is produced.

Re:How Dogbert would handle this

[Thundersnatch]

...the reccomended fix is to patch everybody else's code.

No, the recommended, "party line" fix is most likely to wait for the patch to the ASP.NET execution environment from MS. You can work around the issue using the coding method suggested if you do not want to wait for the patch to be regression tested by MS. Also, I'm sure if you called MS Product Support Services you could probably get an engineer to send you a hotfix (without installer) that was marginally tested today. PSS does not charge for the call when it involves a reproducable bug in MS software. I have gotted such pre-release patches from PSS in the past, before they were released to the public after a lot of testing.

Don't be such an alarmist. Microsoft will post a public patch for this hole, and soon. Of that you can be sure.

Re:How Dogbert would handle this

[fermion]

On my my exercise machine there was an electrical issue. The vendos sent out a kit to fix the problem. I had to install the kit. It was not a big deal. On my car, even the smalles issue, typically requires a mechanic.

The difference is that the exercise machine was 'some assembly required' and the car is not. So, given that ASP is some assembly required, it might be reasonable for MS to push the fix to the code monkeys.

The hitch might be that MS does have responsibilty to put the fix in kit form. I was not required to buy the wire and hooks, cut and crimp, and then test. It was all there. MS may or not be provided the proper level of kit.

Re:How Dogbert would handle this

[Anonymous Coward]

Clearly you don't know how to design modular systems.

Re:How Dogbert would handle this

[16K Ram Pack]

I've got to say at this point, that I'm currently maintaining and supporting an ASP.NET application.

However, next time I'm going to take my chances with PHP, MySQL and Apache.

I'm not worried about 1 little bug, but it seems to me as an outsider that the people in charge of this should have put this in. This to me isn't something that looks like an overflow, but the equivalent of leaving a key under your door mat.

Re:How Dogbert would handle this

[shyster]

Rewrite? Hardly...more like cut-n-paste into a single file per website. See the details in Microsoft's KB.

Of course, any admin worth his salt would already be running URLScan and can sleep soundly without doing a thing since it fixes this exact same thing. Also, IIS authentication mitigates this, as it's not affected - and that's the most common authentication method I've run across. .NET Forms authentication is still relatively unused, as evidenced by the fact that this bug wasn't found until now.

Re:How Dogbert would handle this

[badriram]

I did not take PHP 5 in consideration because even most developers at PHP would tell you it is not considered a production quality engine... yet.

Dont get me wrong I use php too, my website uses mambo running PHP 4.3 and mysql on Windows 2003 and IIS 6. I personally like most technologies out there, just different ones for different things

Re:How Dogbert would handle this

[babybird]

The car analogy is flawed. Your assumption is that microsoft knows exactly what the problem is at this time, when in fact they need to diagnose it and determine the proper fix.

In your car analogy, it would be more equivalent to say that the manufacturer knows that *A* screw will come loose after 10,000 miles, and can lead to the engine falling out. In such a case they would advise customers who own the car that it can happen, and they may be at risk if they continue to drive the car the way it is without modifying an engine mount that will keep the engine in place until they can determine WHICH screw is coming loose after 10,000 miles, at which point they would issue a recall and repair it.

Which is exactly what Microsoft will do when they know what is causing the problem and how to fix it without breaking something else. It is simply foolish to suggest that Microsoft are telling customers to fix the problem and that they will not release a patch for it. What Microsoft are doing is offering advice to customers to protect THEIR data and systems until Microsoft can solve the problem permanently, not telling them to fix it themselves.

Re:How Dogbert would handle this

[myowntrueself]

"Ford execs knew that the tires they equipped all their Explorer SUVs was defective and could explode when too hot on a highway"

Wasn't that because the manual gave a tire pressure suitable for off road driving whereas most people who drive these things are doing so on sealed roads where the lower pressure in the tires causes the walls to squash outward as the wheel rotates causing exessive heating?

ie: the purchasers were not using the vehicle for its 'intended' off-road purpose?

(ok so the *real* intended purpose of the SUV is so that the manufacturer can avoid emissions surcharge as they count as a 'light truck').

Re:How Dogbert would handle this

[Thunderbird1]

It can only be attributable to human error.

Re:How Dogbert would handle this

[Frizzle Fry]

Maybe we should stay away from bandwagons entirely? :)

How about handbaskets? Surely those are safe?

Re:How Dogbert would handle this

[Psychotext]

Hey Timesprout, you've been quoted... heheh: eWeek Article

(Down near the bottom somewhere)

Re:How Dogbert would handle this

[pc486]

Really?

Re:How Dogbert would handle this

[Anonymous Coward]

Hmm... Perhaps.... http://secunia.com/product/3919/

Re:How Dogbert would handle this

[slick_rick]

Like a gallery program?

Re:How Dogbert would handle this

[Anarchofascist]

Mathew 10:34 is a bible reference. Look it up.

Re:How Dogbert would handle this

[Pieroxy]

Wasn't that because the manual gave a tire pressure suitable for off road driving
It was. First of all, it was not the only reason, but only an aggravating factor. And it was clearly a mistake, because mistakenly indicated in the user's manual. The tires were unsuited anyways. Proof is they replaced them all in the end!

The issue wasn't the mistake. The issue was that in the end, if you've seen the movie, "Tyler Durden" was right. If it cost too much to call a recall, then no recall is called for. At the expense of some human life...

This is clearly the disturbing part where the grandparent was totally off.

Re:How Dogbert would handle this

[RenatoRam]

You mean... the KERNEL bug that was fixed simply setting the HD to LBA in the Bios and rebooting?

Yeah, that was hard. NOT!

Re:How Dogbert would handle this

[jsin]

Actually, no.

Alot of machines require the partition table fix described here:

http://www.ces.clemson.edu/linux/fc2.shtml

I have performed both (this partition fix and the asp.net fix) and I can tell you that the partition fix was both more time consuming and nerve wracking.

Not that either was particularily difficult, but one did take longer than the other (even if you just consider the reboots).

Re:How Dogbert would handle this

[metamatic]

Well, Ford may not be exceptional, but they're certainly an industry leader in flaming death. As well as the roll-and-burn SUV, there's also the ongoing issue of rear gas tank ruptures in the Crown Vic, rear gas tank ruptures in the Mustang, and of course the infamous Pinto.

Re:How Dogbert would handle this

[ClubStew]

You paid for ASP.NET? You must be the first. Stop trusting email from Nigeria.

Re:How Dogbert would handle this

[Saeed al-Sahaf]

Dream the fuck on.

Lost productivity

[BWJones]

Oh, yeah. Companies now have to "rewrite their applications to prevent exploits" because of a security flaw in Microsoft's software? Would not it be simpler and easier for Microsoft's customers for Microsoft to fix the flaw? Hey, if I wanted to keep my customers happy, that is the course of action I would suggest. Look, you have 2.9 Million web sites out there that now have to go through and invest a number of hours or work to fix the problem. Let's say the fix is easy and only requires say, three hours to recode and test......that is how many hours of lost productivity to the world's GDP? 8.7 Million hours of lost productivity!

Re:Lost productivity

[wankledot]

Re-writing can happen today, the patch might not. I think it's pretty obvious that the best way to prevent it is to re-write your apps, maybe while you're in there re-writing them you can choose a better platform :)

Seriously though, until MS issues a patch, telling people to change their code makes the most sense. There isn't another option except to wait for MS to get its poop in order... which could take a little while. It sucks, but what else are they going to tell people? You can wait for the patch and be insecure, shut down your site, or re-write the code.

Re:Lost productivity

[clenhart]

It is not a rewrite. You have to add 5 lines of code that will work on any project of yours.

Re:Lost productivity

[athakur999]

What makes you think MS isn't going to issue a fix for this? Everyone seems to be overlooking this part of that sentence:

There's no patch yet, but in the meantime Microsoft is telling ASP.NET developers they can rewrite their applications to prevent exploits.

There is a patch coming, but it's not available yet. Application writers can (and should) fix their applications to address the issue until the patch is available, but those who can't or don't want to won't be unprotected forever.

Re:Lost productivity

[forgotten_my_nick]

> There is a patch coming, but it's not available yet.

However in light of some IE exploits "yet" tends to mean 3-6 months.

Re:Lost productivity

[br0ck]

I agree that they should just fix this instead of pawning it off on all their users, but you should take a few things into account with your numbers. First, according to the linked article, using URLScan fixes this and anyone using IIS should definitely be using URLScan unless they're using Windows 2003 which isn't vulnerable. It also mentions that the vulnerability affects developers using web.config to handle security, which I don't think is very common (but I could be wrong?).

Re:Lost productivity

[jaciii]

Just look at it as 8.7 million hours of IT work. Microsoft is helping the unemployed IT worker. But the question is: Which country's unemployed are they helping.?

Re:Lost productivity

[GSloop]

Perhaps this will fix things.

However, I'm not reassured by MS's explaination.
I quote:
...
Microsoft ASP.NET developers can add more checks to help reduce canonicalization issues for a Web application by adding an Application_BeginRequest event handler in their Global.asax file that is stored in the root directory of the Web application. This event handler executes for each Web request and is a convenient location to insert code to help safeguard against canonicalization issues. ...
The following samples demonstrate how to add an Application_BeginRequest event handler to a Global.asax file. The event handler helps protect against invalid characters and malformed URLs by performing path verifications to help protect against common canonicalization issues.
---


Help is not the same as fix. If these was the only item needed to fix the issue, I'd highly expect different language in giving a work around.

Given MS's past track record, I suspect we'll find this fixes the most obvious part of the problem while still leaving the user vulnerable, but feeling warm and fuzzy in the assurance that the problem is fixed.

Cheers,
Greg

Re:Lost productivity

[bfree]

Re-writing can only happen today if you are able to update the application. Is this not a prime argument for FOSS being demonstrated? I have no idea if this vulnerability could be wrapped into a binary only application or not, but in general this sort of chain of dependency for patching can only lead to vulnerable systems. What about when/if a visual studio bug appears (or a bug in a common component) which leads to security problems in created apps, you wait for MS to tell people and issue a fix/work-around and then for the developers of any apps you use to issue a fix, and while you at it, hope that the developers of the app you use don't need to wait for someone else to update their code before they can update theirs and so on ... not a reliable basis for a business, is it?

Re:Lost productivity

[GoofyBoy]

>Re-writing can only happen today if you are able to update the application.

You update your own code which uses the MS application.

If you can't update your own code then you have bigger problems that MS can't help you with.

Re:Lost productivity

[brettski]

As we write our applications, we always say, "I fix that next time around." Or "That can be restructured in version 2, it's working now." As we all know, we never get back to 'fixing' it. Microsoft is giving us another reason to go back and clean up our code.

Re:Lost productivity

[Spoing]

1. 8.7 Million hours of lost productivity!

'Them's da breaks'.

If you expect Microsoft or any company or project to do the work for you -- you will constantly be disappointed.

Security is and never has been a product, like Clorox bleach, that can kill the offending security glitch by ample application.

That's why it takes many hours -- or proper automation tools -- to secure even a moderately complex Windows system. Even then, it's not secure...till you verify that everything you know that could be exploited has been checked to make sure that it isn't expoloitable.

Run scanners (external and internal), check running processes, turn them off and remove anything you can, know what is running in detail. If you wrote the software, keep security in mind from the first line of code and always consider the environment hostile.

That said, if you pick poorly designed software and run it in a hostile environment...it's still *your* responsibility. One thing you can do is not use bad designs and lock down your systems.

Re:Lost productivity

[discord5]

Companies now have to "rewrite their applications to prevent exploits" because of a security flaw in Microsoft's software? Would not it be simpler and easier for Microsoft's customers for Microsoft to fix the flaw?

Not jumping to the defense of MS here, as I have no particular love for them, but most OSS that has a nasty bug always comes with a workaround so admins can secure their systems until their distribution/compiler/monkey makes another package available.

Let's say the fix is easy and only requires say, three hours to recode and test......that is how many hours of lost productivity to the world's GDP? 8.7 Million hours of lost productivity!

Let's say you have 20 unix machines on which you have to distribute an RPM, or log into and apt-get upgrade, or compile from source. You're spending some time on those machines as well if a security flaw is detected.

The trick is to create an agreement with your customer where you can bill the time you spend upgrading/patching to the end-customer. It's a practice that's quite common in consultancy, and the customer usually likes the idea that some scriptkiddy can't disturb their business. The small cost of the upgrade is usually not a concern to companies compared to the possible cost of a defaced website or the recovery of a deleted database.

Re:Lost productivity

[inode_buddha]

I guess this is the part where we can all "Get the Facts" about TCO.

Re:Lost productivity

[Jim_Maryland]

You are assuming that the company/organization running the ASP.NET solution actually developed and maintains the code. If I am a small company that hired company ABC to develop a website for me because I have no web developers, I'm not going to chance updating the application. I'll have to pay ABC to come out and update the application. This may involve creating a contract or burning up support hours. Most likely though, the companies IT staff would be more willing to apply a patch versus a solution modification. In addition to not being able to update code, you could always find that by making an update without the developers approval, you could invalidate a support agreement for making modifications.

You update your own code which uses the MS application.

Yes, you can update your own code pretty easily, but if the code exist at deployed sites, you may have a problem. For simple sites, your right though that an update like this isn't a big deal. To be fair though, even the the eventual MS patch will require effort for install and testing, but most users are more comfortable applying a patch than updating code.

Re:Lost productivity

[jafac]

8.7 Million hours of lost productivity!

That's rather optimistic.

Sure, a subset of sites are going to have a guy who can just open a text editor, edit a few lines, and problem solved.

Other sites, particularly those belonging to large corporations (more typical of ASP.NET deployments, by the way), will require development time, reload of the test environment, test time, possible additional development cycles, possible integration of other fixes they may have had waiting in the wings, but didn't deploy because there wasn't a critical need. Documentation of changes, regression testing, and finally deployment, which may or may not require downtime (ie. 9pm Saturday evening). Under some organizations, even a trivial engineering change has a pretty steep minimum overhead of man-hours of labor. This will push the average up a bit higher. . .

Re:Lost productivity

[jafac]

. . . on the other hand, a similar exploit discovered in Open Source software would require the same amount of overhead for repair. Hell, even installing a Microsoft patch will require some overhead.

But this is why people choose closed-source commercial development platforms over open source. So they don't have to spend money on their own developers. So, for Microsoft to suggest that a customer has to spend money on developers to fix a security bug caused by their product - flies in the face of their reasoning why a customer should choose them over an Open Source solution.

Re:Lost productivity

[cybermage]

While I agree with what you've said, I feel the need to be logically pedantic here:

"There's no patch yet"

is not the same as

"There is a patch coming"

It is easy to assume that a patch will be forthcoming, but that is not always the case. It could be fundamentally broken -- IE security holes have been such a bugger to close because the application is fundamentally insecure.

Re:Lost productivity

[maxpublic]

If you expect Microsoft or any company or project to do the work for you -- you will constantly be disappointed.

Although you'd think that the largest software corporation in the world just might have caught a bug of this nature prior to release. Or perhaps that they might be obligated to fix the bug, seeing as how you paid for the software with the reasonable expectation that it wouldn't contain a gaping hole of this nature.

On the other hand, considering MS's security track record it might be argued that purchasers should *expect* security leaks left and right based on past experience and therefore don't have any business complaining when MS screws the pooch.

Max

Re:Lost productivity

[Spoing]

I always distrust software. Many of the open CRM projects are horridly insecure or use default administration methods that open the site up to man in the middle attacks by sniffers. ISPs tend to make this job harder too (unless you use a dedicated server - virtual or not).

As for Microsoft, it boils down to complexity and paying attention;

They're big, have complex APIs, and don't have transparency (you can't easily check what they've written).

They aren't really focused on security. They are primarily focused on features, release dates, and usability. If an insecure design leads to more sales -- HO-RA!

Any one project at Microsoft will have many dependencies between it and other projects; even they can't check easily if every other project is doing the right thing. This increased complexity makes it less likely that they will catch these types of problems.

These combine to make it very difficult for them to provide software that is secure. That's why I don't use it when given the option.

Re:Lost productivity

[golgotha007]

holy hell, speak for yourself, mate.

do you work for MS?

Re:Lost productivity

[node 3]

You can wait for the patch and be insecure, shut down your site, or re-write the code.

In other words, it's just like F/OSS where you can fix it yourself or wait for someone else to fix it for you, except that it's harder to fix yourself, and there's only one vendor to fix it for you (and they don't tend to fix these things very quickly).

Even worse, you have to pay for this level of (dis)service? What a sham.

Re:Lost productivity

[node 3]

There is a patch coming, but it's not available yet.

No one suggested otherwise. The problem is that the delay between the discovery of critical flaws and the release of a patch from MS is abysmally long. If the fix is so simple as changing a few lines in a config file, the patch should be out no more than 5 minutes after the web page that tells how to fix it. You can be sure that if this was a F/OSS program that was so widely used, the slashdot headline would have been "Patch Released for Project X Vulnerability"--not because slashdot is biased, but because there's actually a patch!

Re:Lost productivity

[GoofyBoy]

Yes I agree with you that it is a problem, but how would this be different if I went with a FOSS solution? The grandparent apparently thinks that this isn't a problem with FOSS.

If I can't update the code, closed or open, how can I fix this problem? With either way, I'm at the mercy of someone else.

Re:Lost productivity

[Phisbut]

seeing as how you paid for the software with the reasonable expectation that it wouldn't contain a gaping hole of this nature.

With common sense, you sure can expect a certain level of quality. However, big corporations don't know what common sense is, and they make you "sign" some kind of license telling you that whatever they're selling you right now is coming without any warranty, 'as is', and that you shouldn't even expect it to do whatever work you bought it for.

From a standard license :
DISCLAIMER OF WARRANTIES. MICROSOFT AND ITS SUPPLIERS PROVIDE THE SOFTWARE "AS IS" AND WITH ALL FAULTS, AND HEREBY DISCLAIM ALL OTHER WARRANTIES AND CONDITIONS, EITHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO ANY (IF ANY) IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTABILITY, OF FITNESS FOR A PARTICULAR PURPOSE, OF LACK OF VIRUSES, AND OF LACK OF NEGLIGENCE OR LACK OF WORKMANLIKE EFFORT. ALSO, THERE IS NO WARRANTY OR CONDITION OF TITLE, OF QUIET ENJOYMENT, OR OF NONINFRINGEMENT. THE ENTIRE RISK ARISING OUT OF THE USE OR PERFORMANCE OF THE SOFTWARE IS WITH YOU.

(Emphasis mine)
You're simply not allowed to expect your software to work. They don't even guarantee they didn't put a virus in there...

Re:Lost productivity

[SnarfQuest]

Application writers can (and should) fix their applications

You aren't fixing your applications, they aren't broken. You are hacking in a quick and dirty patch to try to hide a problem in the core of the system.

If the car you owned would explode when someone kicked the tire, would you consider it a "fix" if the manufacture told you to duct-tape barbed wire around the tires?

Re:Lost productivity

[Jim_Maryland]

With an FOSS solution, the situation will likely be the same if the company lacks the technical skills to perform the update. I wasn't trying to state that FOSS solutions somehow resolved the problem. I guess I should have read a little more carefully up the post tree.

The FOSS solution does allow one benefit over a closed source solution (not necessarily applicable in this case as the ASP file will be a text file, if I'm not mistaken) is that the recipient of the solution should receive a copy of the source based on the open source license. They could change the code, but even doing this could still violate any agreements for support from the developer as I noted in my original post.

In the end, I'll take patching the software over coding changes though just for the sake of minimizing user error if I had to send a code change to customers. Likely the patch will be simpler to install.

Re:Lost productivity

[AJWM]

There is a patch coming, but it's not available yet.

It'll be fixed in Longhorn.

Re:Lost productivity

[dcam]

Would not it be simpler and easier for Microsoft's customers for Microsoft to fix the flaw

I imagine that Microsoft is going to do this, but for the moment they are recommending a workaround. This is not a bad thing. They are not saying that their workaround is going to be the only solution to the problem.

Bash MS for the stuff they get wrong. For example the fact that this bug should have never occurred. Canonisation issues were a problem in IIS 4 and are a topic specifically covered in Writing Secure Code Volume 2 (which has a quote from Bill G on the front saying that this book is required reading at Microsoft).

Look, you have 2.9 Million web sites out there that now have to go through and invest a number of hours or work to fix the problem. Let's say the fix is easy and only requires say, three hours to recode and test......that is how many hours of lost productivity to the world's GDP? 8.7 Million hours of lost productivity!

Lets say there are 10 million linux installations in the world. Each one takes 10 hours on average to install and configure (over an average of 5 hours for a windows installation). 50 million hours of wasted time. OMG WTF!!!1!!!

Doh!

[JohnFromCanada]

And I thought register_globals was bad!

How many of these will you see?

[Soporific]

http://www.pr0nsite.com/loggedin.asp&sneaky&url&ba ckdoor

~S

Same old, same old.

[gregarican]

From what I read on it on Bugtraq it appears to be one of the good old directory transversal flaws. E.G. if you don't have access to http://server/directory/file.asp you can simply go to http://server/directory\file.asp to access it. That or else use some unicode equivalent. Isn't it funny how Microsoft's leading edge Trustworthy Computing is still vulnerable to the same old sploits?

Re:Same old, same old.

[dook43]

No. I typed in http://server/directory\bin\compiledfile.dll and it still prevented access. It also prevented access to web.config due to its extension. This is a different issue.

Re:Same old, same old.

[mborland]

Since this seems to be a problem with ASP.NET's evaluation of the URI, I'm wondering what their 'long-term' strategy is to fix this problem. Obviously, the short term strategy is to weed out those pesky backslashes in the ASP.NET auth code. However, shouldn't there be a standard tried-but-true method, available to any handler (ASP.NET, ASP, etc.) that parses the URI and verifies whether it is contained within a specific path?

The fact that this affects ASP.NET but not ASP would seem to indicate that they're using different parsing methods. That seems sort of dumb.

Oh, and to be petty--directory traversal is so late-nineties.

Re:Same old, same old.

[gregarican]

Odds are I RTFA. All you have to do is read the Microsoft KB article for the details. If you tried your experiment against a known ASP.NET website, had these results, and know the the one configuration file was untouched then more power to you...

Re:Same old, same old.

[Anonymous Coward]

No, he is correct, that works in mozilla.

For IE use %5C in place of the \ [as IE converts \ to / ]

Re:Same old, same old.

[ConceptJunkie]

I wouldn't be surprised if there are a half-dozen pieces of code devoted to path parsing in all of Microsoft's bloat.

Re:Same old, same old.

[jafiwam]

Well since IIS is the only server affected, the "UrlScan" security configuration tool (designed to allow or disallow various types of things, including URL strings) could be used to block this exploit.

Depending on your application, it may provide a lot of time to fix the ASP.NET stuff without worrying about script kiddies.

I have been looking, but have not found out an answer to if the flaw involves basic authentication done via IIS or if it involves ASP.NET applications specifically...

Re:Same old, same old.

[AndroidCat]

It almost makes me want to try something really goofy like this: http://server.com/%25SystemRoot%25/

Re:Same old, same old.

[dook43]

None of any of those replacements work in either Mozilla or IE to access either .dll files, web.configs, or .aspx pages with NTFS security set.

Re:Same old, same old.

[ConceptJunkie]

Or better yet:

http://server.com/%2Fcon%3A

to get access to the command prompt!

How simple!

[AndroidCat]

Microsoft is telling ASP.NET developers they can rewrite their applications to prevent exploits.

Ah, that's easy then. Do they have a suggestion for which web app platform and OS I should rewrite my apps for?

Re:How simple!

[byolinux]

Clearly it's Web2 for OS/2 Warp.

I hear it's what Al Gore and Tim Berners-Lee made the Internet on before they made AOL[1]

[1] Joke, there.

This is the American corporate way:

[Pig Hogger]

It figures.

This is the American corporate way: blame the victims!

Put the burden of fixing the problem on the end-users...

Re:This is the American corporate way:

[GoofyBoy]

>Put the burden of fixing the problem on the end-users.

Seriously, isn't this the way OpenSource works, since we are all the end-users?

Re:This is the American corporate way:

[AvantLegion]

Put the burden of fixing the problem on the end-users...

Which is, of course, completely opposite of the Linux Way...

"You want feature X? Why don't you Write One Yourself, Damn Luser?"

"Feature Y broken? Fix It Yourself, Damn Luser!"

This *should* be just a bad joke, but I am routinely amazed at how prolific this attitude remains.

Re:This is the American corporate way:

[node 3]

>Put the burden of fixing the problem on the end-users.

Seriously, isn't this the way OpenSource works, since we are all the end-users?

Your comparison is flawed.

In Open Source software, the burden is on the programmers, it's just that any end user has both the right, and are provided with the means, to become a programmer. With Proprietary Software, the burden is quite often put on the end user who is provided with limited or inequitable means to do so.

Rewrite the code!

[Mr. Flibble]

They don't have to worry. All the people with black hats will rewrite the code for them... Free of charge!

Re:Rewrite the code!

[iNetRunner]

They don't have to worry. All the people with black hats will rewrite the code for them... Free of charge!

Oh, I think they'll charge you ... on your credit card! ;)

What's new?

[Anonymous Coward]

In *any* server-side scripting language, you should doublecheck each string you get from an URL, POST, etc.

Re:What's new?

[DrEldarion]

Wait, you're saying that people actually take responsibility for their own security instead of blaming Microsoft for all their woes? BLASPHEMY.

Re:What's new?

[Frag-A-Muffin]

Although I agree with you in general, I would have been more specific. You should always be checking your GET/POST vars.

From the article, it looks like it's simply switching a '/' to a '\' or the unicode equivalent in the URL to an asp page. It seems like you (the developer) would never get a chance to doublecheck this url as this would seem like it's parsed by IIS and has nothing to do with your script at all.

Again, I'm NOT a ASP.NET dev. but I do do web programming, and it seems that checking your GET/POST vars wouldn't do it.

Can anyone clarifying this further?

Re:What's new?

[legirons]

"In *any* server-side scripting language, you should doublecheck each string you get from an URL, POST, etc."

This would be more like your .htaccess files not working -- completely independent of any application-layer security, and used for different things (e.g. password-protecting a whole directory structure of static files, or preventing access to your template files)

Obligatory ...

[Anonymous Coward]

About 2.9 million web sites run on ASP.NET according to Netcraft.

It's official, Netcraft confirms: A whole lotta ASP .NET sites are dying ...

Details...

[JoeLinux]

I guess when it is assumed that your OS is full of security holes, you can issue a press release that more or less just says, "Our security is sh*tty right now", expect everyone to just do a collective, "Yup", and shuffle off.

Re:Details...

[jbplou]

It not like every Open Source solution doesn't have security holes. Lets face it, ASP.NET is a more powerful solution than PERL or PHP. I've used them all and I must say ASP.net is surpirisingly powerful. But security flaws occur in all software so why makes this .Net one seem so horrible.

Obligatory

[Anonymous Coward]

Asp.NOT or asp.Nyet!

Re:Obligatory

[rampant mac]

"Asp.NOT or asp.Nyet!"

Actually, with the various stooges behind Microsoft and stupid, preventable exploits, it should be Asp.Nyuck, Nyuck, Nyuck.

Time to rewrite alright...

[unix guy]

and use asp2php as found on Freshmeat.

Re:Time to rewrite alright...

[Anonymous Coward]

and use asp2php as found on Freshmeat.

RTFA - this is ASP.NET not ASP.

Re:Time to rewrite alright...

[hkb]

ASP != ASP.NET

They are *completely* different languages/technology. Perhaps you should spend more time actually learning than bashing stuff you have no clue about.

PS: How did this get modded up, when it was an obviosu flame? Oh right. It's Slashdot.

Re:Time to rewrite alright...

[Mordaximus]

"ASP != ASP.NET"

Right, that should be *TOTALLY* obvious to anyone and everyone. I guess C++ is *COMPLETELY* different than C isn't it? Perhaps you should take some of your pent up frustration and direct it to the Microsoft product naming idiots. They've generated confusion more than once. Hell, how long did it take THEM to figure out what .NET was?!

"PS: How did this get modded up, when it was an obviosu flame? Oh right. It's Slashdot."

Hello Mr. Kettle.

Re:Time to rewrite alright...

[hkb]

Which part of "Active Server Pages" doesn't make sense to you? ASP is not a language. It's a server-side scripting model. VBScript and JScript are (some of the languages) contained within ASP pages.

You shouldn't assume before criticizing something, you'll end up looking stupid, which it appears you often do.

Yaaaaawn.

[OlivierB]

I thought there already was an exploit like this and they had already fixed it. I get confused by these weekly security announcements.

Oh well, these developers might as well move their stuff to more secure platforms since they need to re-write it.

MS will keep their market domination as long as people have MS windows at home. People will keep MS at home as long as they needn't pay for Windows (either through OEM or piracy). THe day MS ***seriously*** cracks down on license thieves, will the market share move away.

Re:Yaaaaawn.

[skiman1979]

Everything I write is a lie.

That's a lie and you know it.

This is getting tiresome.

[whyne]

"If a visitor to an ASP.NET site substitutes '\' or '%5C' for the '/' character in the URL, they may be able to bypass password login screens. The technique may also work if a space is subsituted for the slash." Is it just me, or is this a bit too simple even for script kiddiz?

Re:This is getting tiresome.

[AndroidCat]

is this a bit too simple even for script kiddiz?

It's their new security feature: Security through Stupidity.

Re:This is getting tiresome.

[tshak]

This is _only_ if you protect at the file level via the web.config (something that is not a best practice in the first place). If you use ASP.NET Forms Authentication and put a security check on an aspx itself (or in your base page class), or if you use any other form of authentication and authorization, this exploit is useless.

This is a stupid exploit that should have been caught before 1.0 was released, but the affected install base is probably very small.

Re:This is getting tiresome.

[16K Ram Pack]

tshak,

Do you have a full understanding of the problem? Neither of the articles goes into what you are saying, but I'd appreciate more explanation.

Personally, I have a system with no password protected folders or files, but I do have forms authentication on them and the roles are defined within the folders (in the web.config per folder) and a custom handler checks the roles in the database based on a user ID in a scrambled cookie (hope that makes sense).

I basically define the roles at folder, not file level.

Am I safe? And can you explain why?

Re:This is getting tiresome.

[sirshannon]

The custom handler may save you in this case. If you were not using a customer handler and were using forms authentication with the roles allowed for each folder defined in the web.config, you would be vulnerable to this because the ASP.NET engine would check for "/Admin/" in the URL (if that is a folder you defined in the config) and if it saw "/Admin\" it would not recognize it as being the same directory as "/Admin/" and thus would not apply the role check. If your custom handler parses the URL (and does a better job than IIS5/ASP.NET is doing) and recognizes "/Admin/" as "/Admin\" and "/Admin%5c" and "/Admin " etc, etc, etc, then you may be safe. HOWEVER, I highly recommend you put the security in the object you're securing. You should also check the user's role in Admin/EditMenu.aspx instead of just at the folder level. When you are doing those checks at the page/control/object/function level, the "/" vs. "\" problem isn't really a problem at all.

Re:This is getting tiresome.

[16K Ram Pack]

The roles are defined in the web.config for each folder, and I have a custom authenticator which sets the roles based on a database.

It sounds like I have some work to do....

The annoying thing to me, sirshannon, is that I'd assume that people working for a giant size software company like Microsoft would parse a URL into a common form before even doing anything else. At least with a piece of OSS software, you aren't paying for it, so can't really complain.

I still don't get...

[halivar]

...why people refuse to use PHP. How far are you going to trust Microsoft to get it right? How many vulnerabilities does it take?

Re:I still don't get...

[Timesprout]

Right, because historically PHP has been an absolute bastion of security.

Re:I still don't get...

[DAldredge]

It may have something to do with the fact that PHP changes too much between minor verions. Or at least it used to.

Re:I still don't get...

[GregWebb]

If you're building stuff to run your own systems, go for it. If you're building stuff to resell to corporate / government clients that they want to be able to install as a turnkey, _you_ try getting them to install PHP...

(Speaking as an ASP coder. Complex monopolies in action, guys...)

Re:I still don't get...

[FortKnox]

Absolutely, I mean, PHP in a large enterprise system? WHY NOT! Scales great, right?

Honestly, saying "why don't people use J2EE?" would have been a bit more plausible... but good luck convincing a large financial institution to use PHP on their giant web apps.

Re:I still don't get...

[FTL]

> I still don't get...
> ...why people refuse to use PHP. How far are you
> going to trust Microsoft to get it right?
> How many vulnerabilities does it take?

Maybe you could help me with this one. I've never figured out how one could make a secure PHP program on a multi-user system. All PHP scripts run using the web server's perms, not the programmer's. Which means all data files must be writable and all SQL passwords must be readable by the web server. Which means other people's PHP scripts on the same server also have permission to write to those files or read those passwords.

[blink] [blink]

What am I missing? As far as I can see, there's zero inter-user security when using PHP. CGI scripts on the other hand get to take advantage of suEXEC which allows them to run under the programmer's perms instead of the web server's. But PHP is left out.

Re:I still don't get...

[Sepodati]

safe_mode and open_basedir restrictions come in handy here, but if you're really concerned about this, then you shouldn't be on a shared server.

Or just run PHP as a CGI where it runs as a user account...

---John Holmes...

Re:I still don't get...

[someonehasmyname]

Actually, it's very simple and can be handled a multitude of ways. Here's two examples:

Build PHP as a CGI, and print #!/path/to/php at the top of every php file. (Like you do with Perl)
Now wrap it with suExec and you're all set.
Observe the *slight* performance hit.

or include:

<Location />
php_admin_value open_basedir "/home/username/public_html:/usr/local/lib/php/:/t mp/:/var/tmp/"
</Location>

into each VirtualHost on your PHP server and it will not allow any file operations to take place outside of the listed directories.

On some sites you may need to add a few other dirs to the open_basedir for whatever you're trying to accomplish.

eg: I shell out to ImageMagick's "convert" a lot, so I add it's path to the open_basedir for that particular VirtualHost.

Re:I still don't get...

[gregmac]

Yeah. It's not like any large websites use php. I was at a PHP conference about two weeks ago, where Rasmus Lerdorf (the lead developer, who happens to work at Yahoo now) was talking about their infrastructure. He didn't give an exact number, but said it was in the area of 10,000 servers (running FreeBSD), and handles literally billions of hits a day.

It's too bad it doesn't scale: once they get 10 billion hits a day they'll probably have to rewrite and switch to .NET or something.

but good luck convincing a large financial institution to use PHP on their giant web apps.

The only problem here is reputation. Microsoft pushes .NET as a large enterprise system, same thing with Sun and Java. No one really pushes PHP, besides people that use it.

There's no reason PHP can't be used to write "enterprise" applications from a technical standpoint. I think the problem comes from the fact that generally schools teach Java, because it was hip during dot com, and .NET, because Microsoft gives them lots of free software when they do. When all your developers - espessially the lead developers and CIO's making language and platform decisions - are trained on a certain platform, that's what they'll choose.

I'd really like to hear the reason you don't think PHP is scalable, or why you don't think it's suited (a technial reason, not by reputation), but to be honest, I don't think you'll be able to give me one because by the way you talk, my guess is the only thing you know about PHP is what you've heard from other people and/or companies who sell a product that competes.

PHP runs on basically every platform (instant cost savings vs .NET). It can connect to any major DBMS. It runs on a ton of web servers, most importantly Apache. It's lightweight, has probably the lowest learning curve of any language (read: your designers can use it), easily extensible with C, and it's open source (so you never have vendor lock-in, and you're never stuck with a problem that can't be solved).

I use PHP for lots of my stuff, and it saves me money and allows me to do things a lot faster than if I was using another language. I don't care if you agree or not, because it doesn't really affect me in the end. It's a competitive advantage for my company - I don't have the overhead of paying extra thousands of dollars per sever for licences, for one thing.

Re:I still don't get...

[FortKnox]

One word: Maintainability

And writing 'scripting code' vs actual front end code are two very different things. Sorry, I don't buy into your PHP propaganda.

Re:I still don't get...

[caluml]

Why does the scripting language have anything to do with the protecting of directories?

Re:I still don't get...

[Lehk228]

PHP is fine, the problem is that many PHP developers are new to web based programming and don't know how to write secure code.

Re:I still don't get...

[SoTuA]

has probably the lowest learning curve of any language (read: your designers can use it)

I don't think I'd feel comfortable letting a designer even LOOK at the code. Designers should stick to what they are trained to do and not meddle in what they aren't trained for. You won't see me picking colors and layout for a website, and damned if I'll let any designer touch any part of the project that isn't a template or stylesheet.

What, me have problems with self-taught people who think they can do SW development? naaaaaah... (real life case: I recently had to modify an app coded by an outside contractor who is self-taught and sneers at "all the time wasted in school": What do I get when I see the source to his app and stand in awe of his 'genius'? Single file, 1600 LOC: one java class, 64 static fields, 41 static methods. Almost half of these methods are lousy reimplementations of stuff that already is in the Java library. What I do with one-liners after 5 minutes of reading the API docs (like date formatting, for example) he feels the need to code into a method with 30 lines. Some genius)

Re:I still don't get...

[FortKnox]

Actually, its nice for the designer to be able to change things around once you actually have something up and running. Java tag libraries and the tapestry frame work are the best examples of how designers can change the page without touching the code.

I'd take some tapestry code tags with java and put it up next to some php code and see which one the designer can manipulate.

Re:I still don't get...

[SoTuA]

Actually, its nice for the designer to be able to change things around once you actually have something up and running. Java tag libraries and the tapestry frame work are the best examples of how designers can change the page without touching the code.

While I will admit I don't know tag libraries or tapestry (my java experience is mainly with pure java apps/web services, my website experience is mostly with perl and templates), I wouldn't feel comfortable with the designer touching anything but the presentation layer of the application, and I achieve that easily with templates. Does tag-library/tapestry modification change the app logic or does it only change the look/presentation?

Re:I still don't get...

[legirons]

"If you're building stuff to run your own systems, go for it. If you're building stuff to resell to corporate / government clients that they want to be able to install as a turnkey, _you_ try getting them to install PHP..."

Actually I'm finding it doesn't always work that way in corporate environments. This is a desktop-app example rather than a web-app, but it's supposed to be pretty similar now.

Take an app written in visual basic .net. Create an EXE. Doesn't run at all.

Install the .net framework. "Requires service pack x"

Get service pack x. Install. "Requires internet explorer 6.01"

Get and install IE6. "Your operating system [Windows NT] is not supported. Please wait while we download the appropriate version of IE"

Computer tries to connect to the internet. Fails (it's on a classified network). IE6 install fails, service pack install fails, .net install fails, your application doesn't run. And you've just wasted half a day (i.e. $500) and lots of stress from fuckups caused by Microsoft's assumption that (a) you will want the latest internet explorer, (b) that it has to be integrated into windows, and (c) that every computer has an internet connection. So you have a problem no solution, people are demanding that it work now and there's nothing you can do to get the program to run.

Great. Just great. So I rewrite the app in Python and it runs without any fuss. Guess that open-source is corporate fortune-500 stuff now, and microsoft software is for hippie losers who don't value their own time.

Re:I still don't get...

[sootman]

Lucky for me, I work in a giant enterprise (to me, anyway... is 10k+ employees 'giant'?) but I work on small apps--calendars for meeting rooms, surveys, inventory management, etc.--thus I get paid to write PHP. Just because you're in a giant soul-sucking conglomorate doesn't mean there isn't fun work to be done. :-)

Re:I still don't get...

[legirons]

"I've never figured out how one could make a secure PHP program on a multi-user system. All PHP scripts run using the web server's perms, not the programmer's. Which means all data files must be writable and all SQL passwords must be readable by the web server."

"The PHP safe mode is an attempt to solve the shared-server security problem. It is architecturally incorrect to try to solve this problem at the PHP level, but since the alternatives at the web server and OS levels aren't very realistic, many people, especially ISP's, use safe mode for now."

PHP

Re:I still don't get...

[DMadCat]

On the flip side I'm sitting here at a PC in a large company whose IT department is mainly run by college grads. I myself am self-taught. It's running an unpatched version of Windows XP with wide open internet access (via IE) and an installation of McAfee Viruscan that can't be updated because, as a user (actually a new SysAdmin/Support person) I can't change the incorrect Repository settings. However I am configured as a local Administrator (apparently necessary on their system to correctly configure Outlook). My point? A college education doesn't bar you from stupidity. Many come out and implement only what they were taught (and can still remember) in school. Many who are self-taught will find it easier to learn from mistakes and are a little more flexible with their ideas of how things work. Perhaps instead of sneering and ridiculing him behind his back you might have sent him some constructive criticism.

Re:I still don't get...

[FortKnox]

Think of it like templates. A (struts) taglib will be something like so:

>html:text name="myForm" property="someProperty" length="12" /<

So it looks like a text box (the name, and property are struts specific)

Tapestry is even trickier. It uses things like <span> tags, which don't "show up" on your page, but exists in the html. So your code can actually double as a prototype. All the code lies back in java files and xml's point the java file to the appropriate jsp/html file.

So, yes, its only the presentation layer that designers would touch. PHP, on the other hand, is mostly written within html, itself, IIRC.

Re:I still don't get...

[Qbertino]

Absolutely, I mean, PHP in a large enterprise system? WHY NOT! Scales great, right?

Honestly, saying "why don't people use J2EE?" would have been a bit more plausible... but good luck convincing a large financial institution to use PHP on their giant web apps.

Curiously enough, the plattform that the Java people nowadays consider the single largest competitor to Java is PHP. And they're damn right doing so.

Re:I still don't get...

[tetranz]

Build PHP as a CGI, and print #!/path/to/php at the top of every php file. (Like you do with Perl) Now wrap it with suExec and you're all set. Observe the *slight* performance hit.

Is the performance hit really all that *slight* if you run PHP as a CGI rather than an Apache module? I had the impression that it was quite significant but I could be wrong.

Anyway, the security of PHP (and I guess potentially other scripting engines) running as an Apache module on cheap PHP shared hosting is a very real problem. My solution to it has been to move to Virtual Private Servers. The prices are comparable to good quality shared hosting and its infinitely more flexible. I'm a happy customer at Linode but others I've used or looked at are:

Rimu Hosting
Rose Hosting
Digital Daze

Re:I still don't get...

[tshak]

A lot of us believe that ASP.NET is superior. That's a whole discussion in and of itself. As far as security, ASP.NET is probably the most secure web application platform to date. This particular vulnurability is the first of its nature (severe external exploit) since ASP.NET was launched. While this exploit is severe, it only affects a small number of applications that use the web.config to define files in which certain users have access to. This is not a best practices approach, as normally your code defines access to features in which case this exploit is not applicable. So no, you can't just go to any ASP.NET web site and swap the seperator and bypass login screens.

Re:I still don't get...

[fupeg]

I guess you haven't heard about Friendster ?

There's also this little site that uses PHP for many of its apps...

Re:I still don't get...

[shiflett]

You're making an incorrect assumption. "SQL passwords," which I assume means the database access credentials, do not have to be readable by the Web server.

Well, that's too broad. Apache typically has a parent process running as root. Child processes actually handle the requests, and it is these that other users of a multi-user system can control using a variety of technologies (this is not language dependent). These processes typically run as nobody.

You can provide your access credentials to the parent process in such a way that only requests for your virtual host are given this information. I describe this technique in more detail here:

http://shiflett.org/articles/security-corner-mar20 04

Re:I still don't get...

[shiflett]

Scalability is such a tired and misused argument, as you've just demonstrated. It's easier to argue that PHP scales than it is to argue that J2EE scales, but then scalability is just part of the picture. Read here for more information and perspective:

http://shiflett.org/archive/46

Also, PHP is behind a lot of huge sites, Yahoo being but one. Amazon.com uses a lot of Mason and Perl. Perl in the form of mod_perl powers a lot of major stuff. Python is important at Google. Where are these J2EE success stories that can justify the rhetoric that gets thrown around?

I think the stereotype that "everything that begins with the letter J is slow" is justified, with the exception of jBASE, and I hear those poor guys are thinking of changing the name of their flagship product because of it.

Re:I still don't get...

[ad0gg]

My company's first experiment in web applications was a php app. When I started, we were recieiving customer complaints about the application being slow. It could have been poor coding,I dunno since I don't program in PHP. CTO ordered me to do a line for line port to asp.net. Peforming asp.net bad practices of using inline code, and having business logic embedded pages, we finished the line for line port. Application ran at least 50% faster, now it could have been that php runs as ISAP filter on Server 2003 and asp.net runs native. But still, 50% faster for the line by line port. But anyway we eventually rewrote the app, and never had a complaint about the app being slow.

Now all our apps are either JSP or asp.net. I'm never programed in php, but the experience with performance issues has left a bad taste in my mouth.

Re:I still don't get...

[GregWebb]

Sorry to hear you had problems but fundamentally no, I don't find that at all, after several years of setting these things up now. VB.Net maybe - ASP no, it just flies straight in and works.

(MS bugs excepted, of course...)

Re:I still don't get...

[angulion]

I supopse there is more overhead when php is used with IIS than with apache.
Main reason besides perhaps sub-optimal code is:
- You didn't use ZendOptimizer, it can have a serious impact.
- Asp and Jsp are caching by default, php is not, but there is more than one cache available for it (which have a big impact as well).

If you have left the php code, try again with the optimizer and perhaps a cache again and tell the results.

Re:I still don't get...

[mdfst13]

As I read your parent, it said that that self taught person sneers at college grads. I doubt that he would listen to constructive criticism.

As you note, this attitude has less to do with being self taught and more to do with being an idiot.

Re:I still don't get...

[dcam]

I've coded some in php, a lot in asp and I'm just starting to code some stuff in .Net. Put simply the language/framework just isn't as good. This is just my opinion, but the .Net environment is really, really nice.

Re:I still don't get...

[halivar]

Could it also be just that he wrote some really, really bad PHP? My motto is: if it doesn't run too swell, blame the programmer first.

Re:I still don't get...

[someonehasmyname]

On modern hardware, yes the performance hit is IMHO very marginal.

I recently setup a machine with quite a few virtual hosts (with each getting on average 100k hits per day) running PHP as a CGI and the only bottleneck I had to worry about was disk access. A RAID-10 array fixed that. =)

Re:I still don't get...

[gregmac]

One word: Maintainability

It's all up to the programmer.

I have many large apps that I've written in PHP that have been around for years, and I can still maintain them. I have also written apps at other companies that I can see are still in use (though I don't know how much code they may have rewritten).

As someone else pointed out, you can write one huge file full of static methods in Java .. that doesn't mean Java is not maintainable, it means the programmer is an idiot.

And writing 'scripting code' vs actual front end code are two very different things.

What's your definition of 'front end code'? I don't understand this comment

Sorry, I don't buy into your PHP propaganda.

Well, like I said, I'm not trying to sell it. I'm just tired of the same old view-point that PHP is useless from developers who have no experience with it. I've never written J2EE apps, and I don't plan to anytime soon because PHP fulfills my needs right now.. but I also don't think it's useless.

Time to go egging...

[happyfrogcow]

...at the MS campus near you! I wonder what MS folks will think of the *SPLOIT* sound of all those eggs hitting their Windows.

Re:Time to go egging...

[gregarican]

Let's all go to http://www.billgates.com/files\private\How Can I Repackage the Same Old Shit in a New Wrapper.doc

Re:Time to go egging...

[byolinux]

I don't have a word processor installed you insensitive clod!

Don't panic just yet

[bigtallmofo]

Anyone that's familiar with .Net has probably never used this technique to secure a page on their site. I believe most people would consider it more secure to set up a virtual folder within your web site and protect the pages within that virtual folder with either Basic or Windows Integrated Authentication. I've never used the web.config file technique to attempt to secure pages that really needed to be secure, and I doubt many other people have either. If you did without taking any other security steps, well... time to re-think that situation. This security vulnerability will prove to be a dud; nothing along the lines of the old ::$DATA exploits and what-not.

Re:Don't panic just yet

[michael.teter]

So you think... but from my experience dealing with state and federal government agencies, their sites are typically ASP and very low quality.

I'd bet I could find a state or federal agency for which this exploit would yield something interesting.

Re:Don't panic just yet

[wcbrown]

I'm a developer on an online banking system and we're using forms authentication (the web.config file technique as you call it).

From what I've seen, IIS 6 and URLscan protect against this vulnerability. Plus, denying all anonymous users throughout the site and opening up only certain pages to anonymous users also seems to prevent this from happening.

I tested our system thoroughly when I heard about this exploit and it didn't break. I don't know why Microsoft is saying that you have to add stuff to Global.asax. Maybe we're using forms authentication a little differently than most.

Re:Don't panic just yet

[Psychotext]

I'm pleased to hear that! I was just thinking to myself: "Hey, I've used forms authentication a few times" (Admittedly including code that checks back end permissions on every page visit). So I'm glad that I'm not the most insecure coder in the world for doing it!

I do read a lot of code / site security books and have passed the MS secure code exam (70-340) to go with my MCSD. It's something that always concerns me though - You never really can know enough.

Bulls$%^!!!

[PincheGab]

Microsoft is telling ASP.NET developers they can rewrite their applications to prevent exploits

In typical anti-MS slashdotter bullshit, the use of the word "re-write" is used quite liberally. A grand total of four lines of code are required per application so no matter how bog the web site is, only four lines of code (typed once in a single source code file) take care of the problem:

if (Request.Path.IndexOf('\\') >= 0 ||
System.IO.Path.GetFullPath(Request.PhysicalPath) != Request.PhysicalPath) {
throw new HttpException(404, "not found");
}

By the way, these 4 lines of code can be made into one line of code... Hardly an application re-write.

Re:Bulls$%^!!!

[Mr. McGibby]

typed once in a single source code file

*Which* source code file pray tell?

Re:Bulls$%^!!!

[Kenja]

"*Which* source code file pray tell?"

If you dont know and you wrote the app then there is nothing Microsoft or anyone else can do to help you.

Re:Bulls$%^!!!

[puffer703]

that's not the point; while the change might be simple (and i'd dare say something you should check for anyways), it's the fact that it has to be made in the first place that's the problem.

Re:Bulls$%^!!!

[FortKnox]

If you architected the app correctly (.NET, so OO), the abstract or base class that handles the actions would be the place to put it.

Re:Bulls$%^!!!

[huge colin]

Please don't be so self-righteous. There are reasons that MS has earned such a reputation.

When developing software/languages intended for secure communications over the Internet, the authors are obligated to perform very extensive testing (which should probably involve hiring outsiders to try and circumvent any security measures.) This particular security problem just reflects MS's generally carelessness -- after all, what would people do if MS wasn't very enthusiastic about fixing problems? Use a different platform?

If, by "anti-MS slashdotter bullshit", you meant "valid complaints about yet another thing MS has botched", then you can ignore this post.

--Colin

Re:Bulls$%^!!!

[beta21]

You are right. It is only a small rewrite. But then after this there is a testing cycle then QA (and sometimes preformance testing).

A lot of organizations can't just change their production server willie nillie!

Re:Bulls$%^!!!

[SirLanse]

The problem is the pages on your site that have just relative addressing. Or if you are using the server's files for some silly reason. Those sections of the application will need changing. I have web pages using Crystal, Word and other utilities that want server addresses not IIS addresses.

Re:Bulls$%^!!!

[TrollBridge]

"But then after this there is a testing cycle then QA (and sometimes preformance testing)."

Don't you do that after a patch? If I were you, I wouldn't want my boss to know about that.

Re:Bulls$%^!!!

[SCHecklerX]

Or put an apache server with mod_proxy and mod_security in front of your IIS servers, and take care of this problem there. Or even do it with mod_rewrite instead of mod_security.

Re:Bulls$%^!!!

[mborland]

By the way, these 4 lines of code can be made into one line of code... Hardly an application re-write.

But this just checks the presence of the one known overlooked character, and performs one 'smell-test' check on the path. What about unicode variations? What about dot-dot variations? How often will this need to be tweaked before a patch comes out?

I agree, it's no re-write...it's a PITA production workaround.

Re:Bulls$%^!!!

[nuggetboy]

global.asax.cs (or .vb) in each application root folder. It's not fun to have to re-compile each app (if you built it code-behind), but not a re-write as said before.

Re:Bulls$%^!!!

[Anonymous Coward]

Mod parent up. This is so typical Microsoft, providing a fix for one specific example of a problem rather than a general solution. Don't these people have some semblance of a brain? Are they simply incapable of generalizing beyond one specific example of the problem? This is worse than a solution, as it provides a false sense of security while the script kiddies laughingly exploit all the other variations. It would almost be funny if it weren't so sadly stupid. And it wouldn't surprise me if the official patch essentially implements the same thing, requiring yet another patch for the next example discovered the next week, ad nauseum.

Re:Bulls$%^!!!

[glh]

Actually, that's a good idea, but the actual problem occurs before your application code runs. Since that is the case you need to code an event sink that is stored in the global.asx file, which is (or can be) a part of every .NET application. It's really easy to fix. I already patched a few of our sites. Anyone using code-behind will have to recompile to make the fix, other wise you can dump it right in the asx file and it will compile behind the scenes. I'll post more info in a JE soon.

mod parent up

[mfh]

How is this flamebait? I think parent hit the nail on the head.

Where do you want to get carjacked today?

[Doc Ruby]

I wonder how many US government websites in Iraq and Washington are running these soft targets? This is the kind of thing that's forced all our Cybersecurity chiefs to resign in disgust.

Amazing Immunity

[ryanw]

Microsoft has had so many bugs and security flaws over the years that companies are completely immune to bad press for Microsoft. I wonder how much more of this people will finally take until they switch to MacOSX / Linux. I would highly suggest the MacOSX route ....

Re:Amazing Immunity

[Anonymous Coward]

Wow! Are you describing the Bush Administration? No matter how much they fuck up or fuck us all over, nothing sticks to them!

Re:Amazing Immunity

[shotfeel]

Because, just like for the last several years, we all know that MS will have all those nasty vulnerabilities fixed any day now. So its really not worth it to jump ship just when they're about to get it right!

Personally, I think MS should get a lifetime achievement award in the Vaporware category for "Trustworthy Computing".

Re:Amazing Immunity

[erobillard]

Oh really, what other security exploits have been discovered in ASP.NET? It's been a few years now, there must be dozens right? Go educate yourself and get back to us. Take care, -e.

Re:Cool

[ThatGuyGreg]

Proactive?! This vulnerability came to light a week ago - neither Microsoft nor their precious MVPs said a word about it until they could come up with some workaround code - not even a patch. I can hear it now... "if you upgrade to IIS6, you won't have to worry"... ugh.

Parent NOT Offtopic

[Daengbo]

Whatever else it is, like maybe a silly joke, possibly insightful, it is not offtopic.

Re:Parent NOT Offtopic

[Daengbo]

Dude... Someone doesn't like you!

Finally!

[Garabito]

No more [registration required] articles on ASP.net servers!

Re:Finally!

[Jesrad]

Duuude, think of the number of porn servers running ASP.NET ! Free membership, here we come.

Now that's a security hole!!

[ShatteredDream]

Sometimes I have to wonder how it is that Microsoft, with all of their talent and wealth, can have so many problems that people of the calibre that their senior engineers are supposed to be could make. I remember talking to one of my professors about software processes and he was convinced that it's possible to have an "error-free" program, this side of the 2nd coming of God and our programming being outsourced to the angels to do for us. Is it a sign that we have matured as users, or that development has regressed that we now consider holes and bugs to be par for the course?

Re:Now that's a security hole!!

[DogDude]

Your professor is an idealistic, ivory tower academic. Remember "Those who can't, teach". That tends to be true. The reality is that their software has a level of complexity that is relatively unmatched in computing. Add together the amount of things that their software does, for the amount of people, on all different kinds of hardware, and you have an insanely complex application/platform. Compare against, say, Oracle, which writes software that does very specific things, not for end users, and is optimized for only certain hardware and platforms. Even Oracle's stuff isn't bug free, or close to it.

Re:Now that's a security hole!!

[BigGerman]

It is actually quite simple.
Best software is created by small, nimble teams. Any corporation has this natural tendency to make any process big and bloated. So the bigger and more successful co becomes, the more difficult it becomes to produce decent software.
Microsoft must be on the far extreme end of this rule.

Re:Now that's a security hole!!

[DunbarTheInept]

It's impossible for a program to be "error-free" because people's definition of what is and is not an "error" is a moving target. Whichever features are most annoying will automatically get the label "error" hanged on them. Let's take a simple example: website fonts. Let's say that a CGI program produces a web page, and that web page is using a font under the assumption that all target browsers will have that font, when in reality some don't, and on those browsers that don't have that font, some small connotations are being lost in the meaning of the text because the italics aren't showing up as italics. Is this a bug or not? The answer depends on whether or not there are other more serious bugs or not. If there exist other bugs, then this font problem will just be flagged as a interface prettiness issue, and not be called an error. If there don't exist other worse bugs, then this font issue will be elevated in importance so that it is called an error.

Basically, from the user perspective, an "error" is "whichever existing feature is most annoying to me", and you can't get rid of the errors because their definition keeps getting wider and wider as you try.

Amazing

[Anonymous Coward]

What amazes me is that so many people still fail to recommend to their customers alternatives to IE and IIS. Are they just too lazy to learn about the alternatives, or do they really think these products are safe to use in mission critical environments?

I know it takes an investment of time to learn to implement viable alternatives, but if you're worth your salt in this business, shouldn't you at least know how to use products from more than one vendor?

This isn't a bug really

[Jakhel]

it was a plot by the guys at Microsoft to gain backdoor access to porn sites. Think about it, develop a system for "secure logins" on the internet (whose business HAPPENS to be composed of 70% porn, 30% other) with a bug that lets you bypass the very login that was supposed to be secure? Riiiight. See business plan below.

Step 1: Develop language for use with "secure login"
Step 2: ???
Step 3: Masturbate!

Re:This isn't a bug really

[ElDuderino44137]

+5 Mega Funny

2 items..

[DelawareBoy]

1 ) I wonder how bad this actually is.. Is this merely "forms" security? Or also the Integrated Windows security? Seems also that if you don't use the built-in security models, this probably isn't a problem.

2) The "fix" according to the article is not bad at all.. Setting the check in global doesn't amount to 8.7 million hours of lost productivity.

Re:2 items..

[micromoog]

2) The "fix" according to the article is not bad at all.. Setting the check in global doesn't amount to 8.7 million hours of lost productivity.

Three hours of testing for a five-line code change is not unreasonable at all.

Re:2 items..

[johnnyb]

"2) The "fix" according to the article is not bad at all.. Setting the check in global doesn't amount to 8.7 million hours of lost productivity."

Did you account for the amount of time the administrator spends in Slashdot complaining? I mean, gosh, this has even rendered the open-source comunity lost hours of productivity to complain about Microsoft.

obBSD

[adavies42]

ASP is dying, Netcraft confirms it!

just rewrite

[suezz]

just rewrite your code everyone - its not our fault its your fault. what crap - everyone should move their sites to OSS and use perl, python, php or anything else you want - it is about choice and the expertise you have on hand or that you want to acquire. whoever uses microsoft anything for production is just asking for it - and to the person who wrote about the mozilla flaw from yesterday - at least we don't have rewrite anything to fix that. I have never had to rewrite/change an app because of a patch from any linux vendor. how long will the corporate world put up with these shinanigans. Switch Now!

Re:just rewrite

[gregarican]

If you'd read the KB article you simply a few lines of code to a global file that resides at the root directory of the web application. While I'll admit the vulnerability is sadly elementary and has existed in previous Microsoft implmentations it's not like Microsoft has asked developers to completely recode every single file of a web application. It's like saying, hey Samba has this really basic flaw. But if you add an entry in your smb.conf file it's okay. It's not the end of the world. It's crazy to think that the security hole made it past their (supposedly rigorous) peer code review process but the workaround isn't too much to ask.

Funny peculiar article

[shic]

From the article : "c:\dir\test.dat, test.dat, and ..\..\test.dat might all refer to the same file."

Now I could understand how c:\dir\test.dat and test.dat might be the same file - but, prey, assuming a hierarchical file system, how can all three be identical given that Windows file systems don't support hard-links? The test.dat is the same as the c:\dir\test.dat file if we are in c:\dir - but then the parent of the parent could not be c:\dir as well.

Re:Funny peculiar article

[BubbleNOP]

NTFS supports hard links. Note how Microsoft conveniently removed the article. I remember reading it a few years ago... *sigh*

Re:Funny peculiar article

[shic]

Are you telling me that the executable search path is traversed when trying to determine which file temp.dat might be? That would seem a very silly thing to do - and not something I've noticed.

Re:Funny peculiar article

[shic]

I stand corrected - though I maintain it is a bizarre example... Since no user-oriented tools exist to manage hard links on NTFS I suspect that they would be rare in practice. In any case - if such a hard-link did exist then I'd expect it would be fully considered in the design of the application making this bug appear somewhat less serious than it, in fact, happens to be.

It's not a flaw...

[going_the_2Rpi_way]

Nah, it's just an "undocumented feature".

OWA?

[kcurtis]

When installing Exchange 2003, a prerequisite is to install asp.net -- so I'm assuming that OWA for Exchange 2003 uses asp.net.

Can anyone confirm this vulnerability in OWA? If it is a problem, is there anything for an administrator to do? I am not a programmer/developer - the MS links didn't seem to have any helpful preventive info.

Re:OWA?

[Anonymous Coward]

Can anyone confirm this vulnerability in OWA?

No, I haven't managed to exploit it. But I've only thrown a couple of minutes at it.

The mailbox pages probably store your credentials somewhere in their state so simply bypassing the login page won't be enough.

Re:OWA?

[erobillard]

The vulnerability does not exist in OWA. The vulnerability requires that the web.config file in a subfolder enforces different permissions than those in a root folder.

Re:OWA?

[kcurtis]

Thanks for the info.

Re:OWA?

[Knightmare]

I'm not Microsoft so I can't say there is no problem for OWA but the whole idea behind OWA is that it uses the user's kerberos ticket and is "trusted for delegation" and contacts exchange with that kerberos ticket to retrieve the mailbox requested. Just "exploiting" the pathing problem won't give you access to anything within exchange.

At least this is how I remember it working, someone please correct me if I am wrong.

Re:Let the tedious flamebait/trolling begin

[orasio]

Mozilla is client software, not server software.

You could have found Mozilla bugs yourself (or someone you paid) if you wanted or _needed_ to.

Noone has to rewrite their server software because of a mozilla security hole. MS bug record doesn't compare to Mozilla.
Mozilla is just a foundation that produces a browser and some other things. A client app.
They don't charge you for using their software , and then cost you much more money. They don't force their licenses on your new hardware.
There is no way you can compare Mozilla with MS.

Hardly a rewrite..

[d_jedi]

1) Insert into global.asax:

void Application_BeginRequest(object source, EventArgs e) {
if (Request.Path.IndexOf('\\') >= 0 ||
System.IO.Path.GetFullPath(Request.PhysicalPath) != Request.PhysicalPath) {
throw new HttpException(404, "not found");
}
}


2) ???

3) Profit!

Re:Hardly a rewrite..

[RomSteady]

Personally, I think it was very responsible for Microsoft to release source and instructions on how to update your global.asax file in order to prevent forms authentication bypassing. This way, web site operators can fix the bug even if they don't manage patches on the web server.

In addition, this only affects people who use Forms Authentication, and while it may let people get to the page, if your site double-checks the authentication on a per-page basis for rights checks like most do, there is no hole.

That being said, given the canonicalization bugs that have hit Microsoft before, I am disappointed that this was not found and fixed before ship.

Re:Hardly a rewrite..

[Anonymous Coward]

Whilst the security article says this affects Windows 2003 systems - well, most of the time that's just not true. Windows 2003 has a tool called URLScan built in to the IIS6 system - the does not allow this URL through. In addition, there's a tool called URLScan from Microsoft which has been available for 3 YEARS which stops this in IIS 4.0 and above in it's default configuration. Unfortunately, this hasn't been pushed since the Red Alert stuff in 2002 (which this also prevented).

Re:heh

[Grishnakh]

It's very unlikely. Pr0n sites are usually big users of OSS software; almost all run on Apache with Linux.

Accepting Responsibility

[unix guy]

I'm beginning to believe that it's time CIOs were taken to task for repeatedly putting their businesses in danger by continuing to require Microsoft products on their servers.

Most /. readers will agree that the OS and most of the MS software is buggy and CERTAINLY less than secure, so shouldn't these corporate "EXPERTS" know it as well? If so then they are intentionally endangering their most precious corporate assets - information.

Where I come from that is a direct affront to the charter of their positions and grounds for termination...

Re:Accepting Responsibility

[The Bungi]

.NET has been live for three years almost. This is the first ASP.NET vulnerability reported. How many vulnerabilities in PHP?

There are going to be more problems found, and they are going to be identified and patched. Just like PHP and everything else.

As always, Slashdot is three days late with this bit of "news" so the only purpose this "article" serves is to let the zealots come out of the woodwork to claim yet again that Microsoft is "teh evil" and .NET should be replaced with some bit of open source that of course has no bugs, exploits or vulnerabilities because it's perfect. And free.

If this is an "ominous warning" I don't know what this is, yet AFAIK it wasn't even reported on Slashbork.

You create something like .NET, put it out there for half the world to hit on and then see if you can go three years before finding a problem with it. I'm sure it's possible; after all free software is perfect.

Re:Accepting Responsibility

[geomon]

Are there ever legitimate complaints regarding Microsoft's products?

Re:Accepting Responsibility

[The Bungi]

Oh, sure.

Unlike free software apparently, where the answer is always "you're free to ask for your money back", "fix it yourself" or "fuck off".

Re:Accepting Responsibility

[geomon]

Oh, sure.

Care to cite some then?

Unlike free software apparently..

Apparently not.

Re:Accepting Responsibility

[The Bungi]

Care to cite some then?

A lot (though not all) IE problems, Nimda, CodeRed, Blaster, etc. Of course how terrible a vulnerability is depends on how much you happen to hate Microsoft - to me this is a non-issue given how long .NET has gone without one and how many people have been trying to break it for three years. And if I was making the same point about PHP I'd probably be "right", here.

Certainly given some people can claim a Mozilla or Apache vulnerability is "no big deal" gives me a great deal of room to claim this is "no big deal", if nothing else.

Apparently not.

Of course.

Re:Accepting Responsibility

[geomon]

A lot (though not all) IE problems, Nimda, CodeRed, Blaster, etc.

Can you be more specific without referring to any competing software?

Please write your response as though no other alternative software existed. Because I can tell you without fear of equivocation that the problems you will enumerate would have existed without the presence of open source software.

The problems that Microsoft's products have, in my opinion, are a symptom of a problem endemic to the company's production structure.

Re:Accepting Responsibility

[The Bungi]

What do you mean "competing software"? Those are worm code names, not product names. Correct?

Re:Accepting Responsibility

[geomon]

What do you mean "competing software"? Those are worm code names, not product names. Correct?

The names cited in the previous post are worms, that is correct.

What I am trying to draw out here is your opinion on whether Microsoft has any legitimate problems with their software, and if so, whether they bear any responsibility for those problems.

Virtually every discussion of Microsoft products on slashdot begin with a "chicken little" description of the problem (although it is fair to say that some problems are that severe) followed by replies by Microsoft supporters who either attempt to minimize the problem, or point to an equally egregious problem in a competing open source product.

To me, the issue is about accountability. I pay for most of my software. When it doesn't function as promised, and the customer service rep that I have on the phone attempts to make it appear that I am the cause of the problem, then I feel I have a legitimate reason to complain about that company.

I read the EULA for every piece of software I install. I know the limitations that the vendor has assigned to my product. I am not complaining about data loss associated with hardware failure or something outside of Microsoft's control. What I am asking is: "Do you believe that there are any legitimate complaints regarding Microsoft's products?"

As I have said, I believe that those problems would exist even without the existence of competing products, so any discussion of them is irrelevant.

Re:Accepting Responsibility

[The Bungi]

What I am trying to draw out here is your opinion on whether Microsoft has any legitimate problems with their software, and if so, whether they bear any responsibility for those problems.

Yes, and yes. "Responsibility" here is of course mitigated by the way they license their products.

followed by replies by Microsoft supporters who either attempt to minimize the problem, or point to an equally egregious problem in a competing open source product.

I don't see how this is surprising to anyone. The whole modus operandi of this "community" is to offer their warez as an alternative to Microsoft products. The problem you see is that most of these people actually believe that, say, I'll be better off using OpenX over CommercialY, which is almost (almost!) always not true. This is one of those cases.

I think it's more of an eye opener for me to point out that this is the first reported vuln on a massive product like .NET in three years while something like PHP has a sorry string of bugs and exploits that stretch back to the very first release. That doesn't mean Microsoft's problem does not exist or is lessened by whatever issues PHP has, not at all. But "ominous warning" and "Microsoft recommends re-writing your code" is a bit too much FUD. It's also par for the course around here.

When it doesn't function as promised, and the customer service rep that I have on the phone attempts to make it appear that I am the cause of the problem, then I feel I have a legitimate reason to complain about that company

Yes, you do. But again let's be fair here - what customer support doesn't suck? If you listen to Slashdot all day you'd think the only company in the planet that makes commercial software is Microsoft. They are *far* better than most of their competitors, especially once you get past the first tier monkeys.

What I am asking is: "Do you believe that there are any legitimate complaints regarding Microsoft's products?"

I don't think you can expect software to be perfect, ever. In that sense, you might feel that paying for it is rather stupid, and that's fine. I've heard many people use that rationale when considering open source - "they all suck, let's at least not pay for it". But to say there's nothing to complain about Microsoft would be too much. There is a *lot* to complain about. They are getting better. They move slowly. If you think they are not meeting your expectations then you vote with your feet. It's that simple.

Re:Accepting Responsibility

[geomon]

But to say there's nothing to complain about Microsoft would be too much. There is a *lot* to complain about. They are getting better. They move slowly. If you think they are not meeting your expectations then you vote with your feet. It's that simple.

I agree with much of what you have written in your last post. While I wouldn't go so far as to say that there is a *lot* wrong with Microsoft's products, I do think their corporate structure leaves a *lot* to be desired when it comes to customer service.

I am definately happy that Microsoft became the software industry's best success story. My home state has benefitted greatly by their presence here. But that success has also grown some warts over time and Microsoft is in need of a serious challenger to improve their product quality. I believe open source represents our best hope for a healthy software industry.

Also, I did vote with my feet - I began to move to open source products. Are they of superior quality in every sense to Microsoft's? No, but neither was MSDOS superior to VAX or UNIX when I made the switch to personal computers.

No software, no matter who produces it, is without flaws. That is a given in our discussion. But the manner in how a company responds to complaints about their product conveys a great deal about how they perceive they customer base. My impression is that Microsoft views its customers as a cash valve.

No offense intended, but I refuse to accept the premise, "But again let's be fair here - what customer support doesn't suck?", despite the fact that it is true. If we users do not strive to hold vendor's feet to the fire, what incentive do they have to improve their products? After all, if you are willing to buy crap products, why should they make better ones? Improving products costs money and/or time (in the case of open source).

What open source represents to me, and perhaps to others, is an alternative to buying crap and not having any leverage to force improvements. Open source may not be a panecea as some would like to think, but it does motivate Microsoft to produce better products. As an advocate of Microsoft products, I believe you would welcome those improvements.

The real issue is whether there is enough competition in the proprietary software market to force behavioral changes within the Redmond campus. I do not believe there is that pressure from proprietary products. Some of that lack is due to the fact that Microsoft has better products, some is also due to the fact that small ventures have a difficult time getting the necessary financing in order to compete. Therein lies the rub: without competitors, Microsoft has no market motivation to improve their products.

You may believe differently, but that is the business of business. AT&T and IBM, as well as a host of other former monopolies, have proven this to be true again and again.

For that reason alone, you and I *both* need open source to succeed.

Best regards.

Re:Accepting Responsibility

[The Bungi]

My impression is that Microsoft views its customers as a cash valve

I can't speak as a *consumer* since I've never really had to deal with that part of PSS, but from a corporate and especially a developer standpoint I can assure you (in my experience at least) that's not the case. Support for server and developer products is excellent. It's gotten better the past few years. You still run into the occasional asshole that asks you if the computer is turned on when you have a problem with MSMQ transport security or a Commerce Server channel or something like that. You still find the odd regional TAM that couldn't spell "Host Integration Server" if his life depended on it. But still. Honestly, that's my perception at least.

As an advocate of Microsoft products, I believe you would welcome those improvements.

Oh, absolutely. I've said it before and I'll say it again: I want open source to succeed. Not because I find it superior (at least in most cases I don't, there are exceptions), but because I want Microsoft to get off their asses and compete instead of dominate. Competition is good; competition breeds excellence. They've been stagnant at the top for too long. For that reason alone, you and I *both* need open source to succeed.

Couldn't said it better =)

Cheers.

Re:How Dogbert would handle this (Furthermore...)

[Ingolfke]

Unfortunately, the few lines required to implement the patch has already been copyrighted by Brian Connolly.

Except for

[plopez]

the fact that all the expensive licensing that the clients pay to MS because the product is 'supported'. If you have to rewrite your applications while waiting for a fix, you may as well use an open source solution because MS is neither giving you the quality product they promised nor the quality support they promised.

Too much blame on MS

[0x0d0a]

Open Source may provide security *benefits* -- that does not make it immune to holes. The same thing could happen to an Open Source package with a broken API.

Have you ever seen Linux software using tmpnam(), for instance? That's an API bug right there.

Look, this is a darn large security hole. It'll result in some *huge* breakins for years to come. *However*, this is not a Microsoft- or closed-source- specific problem. It could happen just as easily to, say, the perl community.

Re:Too much blame on MS

[node 3]

*However*, this is not a Microsoft- or closed-source- specific problem. It could happen just as easily to, say, the perl community.

Water can kill you, so can a hand grenade. Therefore water is just as dangerous as hand grenades.

F/OSS can be compromised, proprietary software can be compromised...

The problem is that if you look with even mild interest into the issue, you'll see major differences.

Such as:

1. Due to the inherent properties of proprietary software, you install today's system with the exact same disk you used 2 years ago. That means a default install today has all the flaws that have been uncovered since the disc went gold. With F/OSS, you are far more likely to have an up-to-date install CD.

2. Update mechanisms for Linux are used far more extensively than for Windows. One of the primary reasons for this is that the goal of F/OSS is to be used, the goal of proprietary software is to make money. For this reason, it's far more likely that a Windows update will come with unacceptable issues than a Linux update.

3. The design philosophy with regards to security between Linux and Windows is night-and-day. Linux tends to disable services unless you specifically enable them, and even then the default options tend to be chosen with security in mind. With Windows (since '95!) you have ports open by default that have been used to crack into the system. With XP, these ports can lead to a compromised system before the install has even finished!

And the list goes on...

Just wondering...

[mmischke]

...if this flaw was discovered in JSP, PHP or Perl, would we see the same degree of venom? ;-) ./ has some really smart readers. Too bad there's so much platform religion. It's all the same crap in different packages. ASP.Net, JSP, PHP and Perl all suck and shine, differently but equally.

Re:Just wondering...

[sid crimson]

Excellent Question.

Granted, Slashdot tends to pick on Microsoft. But I believe Microsoft have earned their reputation.

As for PHP and/or Perl, and similar problems to today's ASP.Net exploit (I've excluded JSP because I'm ignorant to this detail)... OSS has historically been exceptionally fast, efficient, and thorough when releasing fixes to exploitable code.

How many times has an OSS fix borked your production server? Probably not often. MS has earned a reputation for the contrary.

How long have we had to wait for the typical OSS fix? Sometimes a few days, but typically less than one day. MS has never been so fast.

And the number one reason: What happens if an exploit is found in an abandoned OSS project that you rely on? Well, chances are you have the code. While you may not be able to fix the code yourself, it is *possible* to get it fixed because the code is not locked away in Bill G's mansion.

I do not have the skills to find or fix exploits. But I understand the value of empowering and equipping -- and that is one thing OSS does well.

-sid

My favorite...

[someonehasmyname]

That's pretty funny, but my favorite is still this one

The two faces

[Swamii]

Today an issue was discovered with Mozilla Firefox which, in the rare case a .config file was used to manage the security and permissions of a folder on a web server, a specially crafted URL could access the contents of the folder. Users are recommened to apply a small code patch to fix the issue.

about face

Today, yet another huge security hole was found in Microsoft software in which blows open all websites running ASP.NET. Microsoft's response? Re-write your code to fix the problem! Just another example of Microsoft's "blame the victim" mentality, when oh when will the madness end?!! We should all switch to Linux and Mozilla and Apache today because those apps never have bugs.

Re:The two faces

[_Sprocket_]

When you're going to attempt to point out hypocrisy, it would help to use real examples rather than just make up stuff. Otherwise your point is going to get lost in accusations from straw men arguments to simple ignorance.

Re:The two faces

[tshak]

Today, yet another huge security hole was found in Microsoft software in which blows open all websites running ASP.NET. Microsoft's response?

This is just plain false. Hardly any websites running ASP.NET are even affected by this flaw as they don't use the web.config to secure files. Microsoft's current workaround, if you are one of the few that this actually affects, is very reasonable: a ~3 line code snippet that needs to be placed in one file for each affected application until the patch is released.

Re:The two faces

[Swamii]

My point exactly; Slashdot is continually posting sensationalist, false headlines intended to enflame the tech world against Microsoft.

Re:The two faces

[Gopal.V]

> about face

Depends on how much I paid for it .

When I pay to get a commercial app server, I expect stability, reliabilty and security . But when I download a 1.0 beta release, I get what I'm told.

when "You get what you pay for" becomes "You think you got what you paid for" it's called "Idiot Tax"

Hmmm what would Strongbad say?

[Spy der Mann]

*falls on floor laughing*
BWA HAHAHAHAHAHAH!!!

hacking by query string! Every year gets better!!
*cleans teardrop* (sighs)

How about this?

[gregarican]

Here's a vulnerability or two right here. Too bad they are in the revered PHP platform. Just to show that no one is immune.

Re:How about this?

[UfoZ]

Did you even look at what you're linking?

It's an exploit for a third party PHP project someone has written. Not a core vulnerability in the language. I'd wager that about 95% of PHP vulns are the fault of idiots who write crap like this:

if(isset($show)){

if($show == "new" || $show == "pop" || $show == "cool"){

include("include/show.php");
} else {

include("include/$show.php");
}
}

But this vulnerability is for a third party application, and also assumes that the attacker already has ftp access to the system he's compromising.

Now I'm not saying that PHP is rock solid, but at least look at what you're linking before posting the kneejerk "PHP is insecure too!!!1" stuff.

Re:How about this?

[gregarican]

My bad. Here's the parent of the threads I ran across this week pertaining to PHP (in)security.

Re:How about this?

[UfoZ]

Now those are real vulnerabilities, I'll give you that :)

Fortunately they're patched in recent versions - obviously, with enough common sense PHP (and probably ASP.NET as well) can be kept secure.

Re:How about this?

[asdfghjklqwertyuiop]

Think about it... what is this whole slashdot story about? People gaining access to files in directories that the webserver usually requires a password to get into. Imagine sending "../some/private/directory" for the show parameter.

Re:How about this?

[UfoZ]

Unless they have ftp access to the server, they can't do anything genuinely malicious - that's mentioned in the linked bugreport.

One thing they can do is make it include ../index.php - throwing the server into an infinite loop. Hammer that url a couple of times and you have yourself a mini-DoS attack. (php will time out after 30 seconds of including the same file over and over, probably)

Re:How about this?

[hackstraw]

The $show example is not PHP specific. That is just bad web programming, and that can be done in C, ASP, Perl, shell, or any language. If the web developer blindly uses user input unchecked to access a resource on the webserver, then that web developer made a mistake.

Granted there have been PHP issues, but this is not one of them.

Re:How about this?

[Lando]

Hmmm,
Not sure I would call this a vulnerability. You have to have a script designed specifically that ignores looking at user submitted data. I don't consider this an issue any programmer should know that you don't trust tainted information without verifying it.

If this is the same vulnerability that Microsoft has, I would say that it's not a vulnerability at all. I personally design all my scripts to load data from outside the webpage area and see the ability for a script to read outside of a sandbox and a feature.

Re:How about this?

[shiflett]

And this reveals a common misconception. Rather than pointing out the obvious flaws in your statement, let me ask if you think C has a lot of vulnerabilities. After all, I know a lot of software written in C that has had buffer overflows. Surely that's the fault of the language, right?

I think it's time to quit supporting this theory that developers aren't accountable for their work.

That is not the issue

[spideyct]

I understand your reaction, but you are misunderstanding the issue.
Your post seems to implicate the application developers.

The URL based security is a built-in functionality of the framework. The framework handles all of the checking for you, so you don't have to do that checking yourself. If the framework works as advertised, the developer SHOULD NOT be doing these checks. That is the benefit (and problem) with working with a higher abstraction.

Unless you are doing these checks with machine code, you too are depending on some other pre-built library or compiler to do it correctly.

If the library or compiler (or framework) does it incorrectly, don't blame the application developer.

It ain't just asp.NET

[ajs318]

It's not just asp.NET that's affected by bad programming. We use proper computers on our Intranet, not these silly Windows toys. Doesn't mean we're immune to the effects of sloppiness, though. The other day I found an application written by a subordinate of mine, where you could defeat an authentication check by setting a variable in a query string. You could say it's my fault really, for leaving register_globals on; but I find that 90% of the time it's a PITA having it off -- you might just as well be using something old-fashioned like perl if you're going to do that. When you have to read your variables "by hand" you can be sure what order you do 'em in. Sessions - who needs 'em? Just store a filename in a cookie and put the variables in the file, that's exactly how ASP and PHP do it! (Wonders: does having learned to do something the "hard way" first make you less likely to foul up when you come to do the same kind of thing a slightly easier way?) If you're going to be living in a house, you want housey stuff like electricity and plumbing, otherwise you may as well be living in a bender ..... if I'm going to be using PHP, I want PHP-like stuff otherwise it may as well be perl, but with far too many unnecessary round brackets {I grew up on British BASIC dialects which were similarly unfussy; SIN theta was as good as SIN (theta) but it saved you two whole precious bytes}.

I'll be having a word with him about it when he gets back. I distinctly remember telling him to be careful where certain variables came from. I haven't checked his code too closely yet, because I've had other things to deal with; but if I find $auth=$_SESSION["auth"] commented out, I just might have to kill him.

Re:It ain't just asp.NET

[mabu]

You get what you deserve for leaving register_globals on. It might be a PITA having it turned off, but explaining to all your customers that some guy in China will now be using their credit card numbers to purchase computer equipment might be a bigger pain in the ass.

Re:It ain't just asp.NET

[Sepodati]

Leaving register_globals enabled in PHP is not a security issue. Sloppy programming can cause security issues and that can happen with register globals enabled _or_ disabled.

It's turned off by default for the "greater good" and to hopefully help protect scripts written by new or sloppy programmers.

---John Holmes...

Re:It ain't just asp.NET

[ajs318]

The only disadvantage of register_globals is that it allows you to overwrite session or cookie variables from the query string or, if your attacker is smart, by modifying post-data. If you turn it on, you just have to remember, if you want to be sure of where a particular variable came from then you have to read it from there -- not rely on the automagic variable population.

If you have lots of variables to pick up, and most of them are not particularly sensitive, then you may as well have register_globals turned on and just read the sensitive ones directly from $_SESSION or $_COOKIE.

IMHO though the default order of reading is broken; it would have made more sense to go get - post - cookie - session, i.e. in descending order of tamperability, so an addition to the query string could not overwrite a session variable {which is quite secure as it's held in a file on the server; the file is identified by a cookie, but there is a low probability of hitting a valid session file just by guessing.} Still, you can change this in php.ini or .htaccess if you so care.

For the record, the fix is pretty low impact.

[kevlar]

The fix is pretty low impact wrt webapps. Its merely a matter of adding an event handler to the Global.asax file. The vast majority of webapps do not even touch that file because its mostly auto-generated.

Saying that they need to "rewrite their applications" is incredibly misleading.

It's nost *just* the coding required...

[infinii]

Ok so it's not an application rewrite. Ok so it is ONLY a 5 line patch.

Does no one here work in an organized company that has rigid procedures such as TESTING?!?!

What about the downtime of those apps while you do the patching and testing and redeployment?

So what if you don't need 2 weeks to write every ASP.NET application in the company. You do need the resources to test each application. No matter how much you try to play down the crisis, this is going to cost the corporations M-O-N-E-Y.

And what happens when MS gets their act together and releases a patch? Are you simply going to run the patch and leave it at that? No need to test all your applications against that new version of ASP.NET? For those of you who write applications that select * from grommets and display tables on a webpage, this might not be a big deal. But those of us doing heavy duty enterprise development will see a higher impact.

IIRC, Java hasn't had any of these type of problems within their development platform.

Re:It's nost *just* the coding required...

[tshak]

Does no one here work in an organized company that has rigid procedures such as TESTING?!?!


Yes, and such organizations with rigid procedures wouldn't be securing files via the web.config for their applications in the first place, so they wouldn't even be affected by this exploit.

Word mangled by unpatched security hole

[AndroidCat]

It just gets better and better.

By Laura Berrill, Techworld.com October 07, 2004

A highly critical and unpatched security hole in Microsoft (Profile, Products, Articles) Corp.'s ubiquitous Word software could be used to launch a denial of service attack and give system access.

Discovered by HexView, the hole affects Microsoft Office 2000, Microsoft Office XP, Microsoft Word 2000 and Microsoft Word 2002. It was discovered Thursday and is currently unpatched. [snip]

I guess the idea is to completely numb people about secuity problems. "Oh dear, another highly critical security bug, yawn."

Is MONO also vulnerable?

[Spy der Mann]

I think not :)

Well fellas, that's another reason to move away from the MS Goliath. He's been falling TOO often!

again?

[qtone42]

With M$'s track record for secutiry, I fail to see why everyone's panties are in a bunch. Unfortunately, we should be used to this kind of crap from them by now, not surprised or panicky.

Don't we have an SOP for microsoft security announcements by now?

--Qtone

Bogus

[icebattle]

The email looked so bogus that I figured it must be a phishing attack. But I checked out the urls, and sure enough...

Atlest

[deadmongrel]

Interesting point. But atleast you don't pay a lot of money to someone else and do the job yourself.

migrate to mono ASP.Net

[chmod u s]

First off, this is not a huge deal. Anybody with even a moderately complex ASP.net site has probably written custom authentication anyway. As is typical, the /. anti-MS crowd (into which I am normally grouped) have already blown this way out of proportion.

What would be interesting would be if mono and their re-implementation of ASP.Net got a boost out of this from the migration of some of the more run-of-the-mill ASP.Net websites. I see very few mono ASP.Net sites, and even less buzz about it.

Its not a bug its a feature!!

[BagOBones]

In windows explorer or a command prompt try the following path.

C:/windows

or in a command prompt "cd C:/windows"

Windows will be happy to correct it to C:\windows and execute your request.

I don't think its a .Net only issue.

Definitive Analysis

[Anonymous Coward]

Having read the bug description, cause of the bug, and solution to the bug, I have the definiteve response. On one side, you have the idiots saying 'OHMYGODYOUHAVETOREWRITEAEVERYTHING!'. ON the other side, you have the idiots saying 'This is nothing'.

1) The problem isn't incredibly awful in and of itself. Fixes would take roughly two minutes and could actually be automated. Simple as that

2) The problem is indicitive of Microsoft's biggest problem. Security. This is not an unknown issue. I check my code for similar issues. It is the most fundamental thing abou security: Check the damn inputs. They should have white papers (they do actually) on this. They have trained every employee on this (they took a few weeks off just to schedule clases on this and other security issues). It is a very basic problem. Yet it recurs too often.
Granted -- it is easier to say than do. The people who say a bug like this should NEVER happen have never coded in a real work environment. Things do slip through the cracks. But it happens to Microsoft too often (admittedly less than five years ago, but still too often).

Bottom line. It ain't the end of the world. But it is indicative of a deep cultural problem that Microsoft has to overcome before someone overcomes Microsoft.

Sincerely,
AC

Defense in Depth

[sirshannon]

IIS6 is not vulnerable to this. IIS5 is vulnerable but there are security tools that should be running on IIS5 servers (URLScan and IISLockdown) that will block this attack.

Unfortunately, it appears that many (most? all?) shared hosting providers are not running IISLockdown nor URLScan because all of the hosted sites of mine that I tested were vulnerable (except for the ones hosted on Win2k3). So, for those of us doing the shared hosted thing, we needed a fix.

Defense in depth is always a good practice but ASP.NET's directory security was just so dang easy that many of us used it and didn't do security checks on the individual pages and functions like we should have. I admit I am/was guilty of that about 50% of the time (estimated Frida based on the work I did to correct every ASP.NET site I've ever done). I have code in each page now that checks authentication instead of relying on .NET's built-in security checks since those are apparently based on the string path and there is always another way to fake a string (server phishing?). I posted a little piece of code here that shows how I check authentication/authorization at the page/function/control level.

Microsoft's suggested workaround is easier because you put the 3 lines of code in 1 place, but after this security scare, I don't think I will ever rely on ASP.NET directory security (nor should I have ever relied on it).

Re:Defense in Depth

[Psychotext]

Thank you... I've been beating on my server since the exploit was posted and I just couldn't work out how to get it to happen. Strange that the MS article (http://www.microsoft.com/security/incident/aspnet .mspx) states that Server 2003 is vulnerable.

Re:Defense in Depth

[sirshannon]

I saw that the MS article states that Win2k3 is vulnerable but I haven't seen/heard/read of anyone who can verify that.

Re:Defense in Depth

[glh]

One thing to be aware of- IISLockdown, while very secure, also causes a pretty significant hit on scalability. If you are running a huge site then be careful if you install this tool. I'm not sure what the impact on scalability is for the proposed fix just yet.. I'm guessing it's probably not as much overhead though.

Re:Defense in Depth

[sirshannon]

Do you mean URLScan? If you mean IISLockdown, can you post a link to more information about this?

Granted

[mfh]

It could happen just as easily to, say, the perl community.

Granted, you are correct, but I might add that while such things might happen to Open Source communities, since we aren't paying for such things, we are less offended when they break. When Microsoft fouls up, we all get mad because we've maybe paid too much money for the product/license to begin with so we believe it should function better than a free solution. Sadly the opposite is often more true!

More often than not, Open Source solutions operate better than Microsoft products for any given circumstance.

Re:Granted

[Zinho]

You make it sound like a bad thing that volunteer programmers working on Free Software projects spend their time on things that they are passionate about. I think it's rather a good thing.

What's the difference between the Free Software community volunteers saying "I'm busy, it's free, fix it yourself" and Microsoft saying, "You've paid for it, our EULA indemnifies us, and we know you're not going anywhere, so quiet down while we work on stuff that makes us money"? A bug that a distributor won't fix stays buggy, regardless of the ditributor. Free Software and Microsoft both have their share.

The invitation of "fix it yourself" should actually be te selling point for the PHB! Any company who cares deeply about the security of the web browser it uses can, for the price of a newly hired employee, fix the bug itself, without depending on the goodwill of an apathetic software distributor, be it Free or closed software. If this employee costs less than the yearly licensing fee for the alternative, this is a net gain for both the company and the Free Software community. Everyone wins but the apathetic closed-source software vendor.

You illustrate excellently the difference between implementing Free Software solutions as an individual and doing the same in a large organization. An end user who cares about a bug being fixed can do very little to make the fix happen, unless that user is also a programmer and has time to devote to it. A corporation that cares that a bug gets fixed can spend the money required to get the needed expertise and devote the timre required.

But at least its an equal opportunity bug

[museumpeace]

for mozilla users. The artcle says the bug works differently for Mozilla than for IE browser.
OK, seperate but equal will have to do. Anybody got a list of asp.net servers they want to open up?

It still costs an hour

[HangingChad]

Even if it only takes me ten minutes. Minimum charge is one hour. I rip on MSFT but I should be more greatful because if their crapass software actually worked like it was supposed to I wouldn't make near as much money supporting it! HAHAHAHAHA!

Let me get this straight...

[MmmDee]

I'm probably clueless for not seeing the answer to my own question, but: Why is it the user's fault for not adequately protecting their wifi networks, but it's Microsoft's fault for programmers who FAIL to follow reasonable coding standards and documented security guidelines?

The linked MS article has a reference to a very well written security guideline, just as many home router/gateway manufacturers have documentation in their user manuals about WEP/WAP. If a businessman/woman or grandma/pa is expected to RTFM about their home network, I suggest programmers and web designers have at least an equal responsibility to follow manufacturer's security-related advice.

I'm not totally clueless. I realize this is /. and the article is the obligatory, daily, "let's bash MS" post.

Still a problem!

[Spoing]

1. In typical anti-MS slashdotter bullshit, the use of the word "re-write" is used quite liberally. A grand total of four lines of code are required per application so no matter how bog the web site is, only four lines of code (typed once in a single source code file) take care of the problem:

Actually, those 4 lines do not fix the problem, they help.

Look here for a good explanation.

For every security hole I see with this comment

[phorm]

I always think...

One less, of course

'Just a patch' is something of a misnomer

[sempf]

OK, I am an independant programmer that writes most of my code in ASP.NET. I'll give a taste of what this does to people like me.

Remember, there are actually TWO vunerabilities that affect programmers in Microsoft right now - the GDI+ JPEG overflow and the new canonicalization overflow. Microsoft has fixed neither effectively, so the coders have to fix both.

I manage eleven ASP.NET sites and five C# Windows Forms applications. Between those sixteen apps, I need to:

- load them up in Visual Studio
- Go back to the last stable build in SourceSafe
- fix the reference to GDI+
- add the mappath check to the Global.asax file
- munge the global error handler so I don't get 12,434 error emails when the hacks start coming
- compile
- regression test the app
- redeploy

Now, admittedly, that only took about 20 hours for all 16 apps, but for CRYING OUT LOUD can't they just test this stuff BEFORE they send it out? I have the highest respect for the ASP.NET team, I have worked with many of them on the many books I have written on the topic. Nonetheless, I now have to spend 12 precious, non-billable hours on a problem that is covered at length in 'the bible' - Howard and LeBlanc's Writing Secure Code 2.

Why do I write in ASP.NET? It is FAST - much much much faster than Java or perl or CF any other middleware out there. It is perfect for what I do. But how many of these are there? How many security flaws that the black hats know about that we don't?

It's a little frustrating.

S

Re:'Just a patch' is something of a misnomer

[AndroidCat]

Isn't that part of your job description?

Note that he said unbillable hours. If you're not getting paid for it, it's not much of a job, is it?

Re:'Just a patch' is something of a misnomer

[sempf]

Not when they are my problems. But for a broken product? You bet! I whine like crazy!

Re:'Just a patch' is something of a misnomer

[cablepokerface]

I manage eleven ASP.NET sites and five C# Windows Forms applications.

I write C# to, and lots of it that is. But we had to fix it once, you see, we use a thing called reusabillity, where we let the global.asax in each web app inherite from the HttpApplication implementation in our main product.

Ok, I was a little sarcastic, but the point is, if you have eleven asp.net sites, you seriously need to consider base implementations for things like global.asax and default asp.net page objects. I would go so far as to say that none of your objects in your sites inherite from a .NET base class. They all inherite from your core product, with which you prevent problems like these ...

Re:'Just a patch' is something of a misnomer

[cablepokerface]

Oh yeah, forgot to mention, we have about 250 sites. :)

Re:'Just a patch' is something of a misnomer

[KilobyteKnight]

you know if software development is too frustrating for you, you can give a shot at flipping burgers at mcdonalds. You sound like an engineer who whines about having to do fixing and testing. Isn't that part of your job description?

I used to do tech support for a local Wendy's franchise. You think that guy was bitching? You should hear the burger flippers bitching about thier headsets. And in their case, it was usually their fault, not the equipment's fault.

Re:'Just a patch' is something of a misnomer

[jonathanduty]

, I now have to spend 12 precious, non-billable hours on a problem that is covered at length in 'the bible' - Howard and LeBlanc's Writing Secure Code 2.

Why do I write in ASP.NET? It is FAST

This is actually a re-occuring theme that I keep seeing. Sure ASP.NET is fast to program with "Out-of-the-box". It requires less design and with Visual Studio, less skilled developers can build apps (I'm not saying all ASP.NET developers are less skilled). But in the long run it costs you more, either when it comes time to update existing, un-designed, software or handle security problems like this.

Re:'Just a patch' is something of a misnomer

[dAzED1]

its a CODB, and a hazard he has to accept when choosing to use MS products.

Re:'Just a patch' is something of a misnomer

[danheskett]

This is actually a re-occuring theme that I keep seeing. Sure ASP.NET is fast to program with "Out-of-the-box". It requires less design and with Visual Studio, less skilled developers can build apps (I'm not saying all ASP.NET developers are less skilled). But in the long run it costs you more, either when it comes time to update existing, un-designed, software or handle security problems like this.

What ASP.NET does is require less of the error prone programming that makes programming for the web rather expensive.

Things like forms programming, session management, database abstraction, etc can take a lot of code in some environments. This code is often pretty static, and fairly prone to errors and maintainability problems.

ASP.NET is both fast develop with and fast to execute. It is also very very easy to write extremely re-usuable code.

The bottom line? Even with the road-bumps that come out from time-to-time it's a choice platform for web application development.

Re:'Just a patch' is something of a misnomer

[AndroidCat]

The Consultant's Curse:

When the customer has beaten upon you long enough, give him what he asks for, instead of what he needs. This is very strong medicine, and is normally only required once.

Re:'Just a patch' is something of a misnomer

[sempf]

That would be WONDERFUL.

Aside frthe fact that they are on 11 different machines, on 11 domains, behind 11 firewalls.

S

Re:'Just a patch' is something of a misnomer

[NutscrapeSucks]

First of all, it's hard to imagine the skill-level of web developers getting much worse. :)

The nice thing about ASP.NET is that the output produced by a "less skilled" developer is still not that terrible. It might have maintainability problems like cut-n-paste code, but is far less likely to have SQL injection and cross-site-scripting problems or tons of HTML generation spagetti. I'll take crappy ASP.NET code over crappy ASP or PHP code any day. You actually have to fight the environment for many bad practices.

> handle security problems like this

This only seems to affect a certain class of applications that rely on password security. If your app is designed for the public interenet and handles its own logins, it doesn't seem like a problem.

Re:'Just a patch' is something of a misnomer

[sempf]

There has been an update by bgold:

Today we posted updated information to http://www.microsoft.com/security/incident/aspnet. mspx with additional information about the nature of the reported vulnerability and an additional mitigation best practice. Our additional guidance is an HTTP Module that you can install onto a server that will mitigate all ASP.NET applications on the box and protect them against canonicalization issues we knew about at the time of publication. This is easier then updating the global.asax for each application and if you are dealing with a whole lot of servers much easier to deploy. You can grab the MSI installer for the HTTP Module at http://www.microsoft.com/downloads/details.aspx?Fa milyId=DA77B852-DFA0-4631-AAF9-8BCC6C743026.

FYI...

S

Re:'Just a patch' is something of a misnomer

[cablepokerface]

Are you kidding? Compile time inheritance? Add a reference to your project when you start developing it, inherite your global.asax (the HttpApplication) from the one in your own base classes and compile ... what does that have to do with 11 domains 11 firewalls ... blabla ... ??

During compile the dll of the base class it uses is being compied to the output directory of your project. Simple. So, with an adjustment such as this you only need to adjust and deploy your base classes dll.

Re:'Just a patch' is something of a misnomer

[JacobO]

I'm totally with you on this one. I wish we'd started earlier with this on our product.

Re:'Just a patch' is something of a misnomer

[Tony-A]

Unbillable hours.
Your employer pays you for those hours.
Your employer can't bill someone else for those hours.
Pretty much irrelevant as to how much of a job it is.

The war on the web server front

[WebCowboy]

Microsoft has pretty much never won a battle against open source on this front. It has never exceeded 35 percent in market share and it seems stalled at about 20 percent with no signs of movement. It got where it is today by putting the smackdown on other proprietary systems (Netscape/iPlanet/Sun), with little or no switching from Linux and BSD.

It seems that any movement above the natural stable point in the low 20s is temporary. Every time IIS makes a big move in market share it only lasts a few months...then a "Code Red" sort of crisis scares people away and they never come back--even if there is a patch offered it seems that deploying the patch is too much trouble for hosting companies ans do they resort to bringing the old Suns back online or switching to Linux or BSD--becasue they never experience disruptions on the scale of those inflicting IIS.

Interestingly, this puts a hole in the MS-friendly argument that "people hate them because they are popular" making it the lead target of crackers. In terms of RATE of attack (percentage of total servers attacked--NOT absolute numbers), market leader Apache is NEVER attacked as much as distant also-ran IIS. If it was ONLY about crackers boasting of their skillz in bringing down big, popular sites, then Apache would be attacked far more often. Sad truth is...IIS is just that much easier to crack.

Re:The war on the web server front

[danheskett]

Calling IIS an "also-ran" is a bit of stretch.

(Pre-note: IIS is a security also-ran. Big time defects in thinking and implementation.)

The thing about IIS is that it is very typical for one installation of IIS to run one or less website, while it is very unlikely that this is the case with Apache.

This occurs for a lot of reasons. Lots of ISPs use Apache, because it's free, easier to configure in a scripted fashion, and generally all around more suitable for a hosting setup.

However, a large number of businesses with sites that are self-hosted run on IIS becaue that's what there IT department knows, what their network runs ons, etc.

If you look at any given site that runs against IIS this generally represents one Windows NT/2k/2k3 server. Again, there are lots of places selling Windows hosting, but for most purposes, it's not very popular. Apache/Linux/Generic hosting is much more popular and heavily advertised.

This leads to a less than accurate view of results. For example, virtually all nerds who run their own server are running Apache or Linux in general. That just makes sense. It's free, runs on less hardware mostly, has a great community for hacking, etc. These sites though are very lightly trafficked generally. They are not the top ten blogs, etc.

I guess what I am saying is this: I'd like to see a breakdown of market share by bytes or pages served. I imagine here we would see much better MS performance.

Re:The war on the web server front

[Anonymous Coward]

It seems that any movement above the natural stable point in the low 20s is temporary. Every time IIS makes a big move in market share it only lasts a few months...then a "Code Red" sort of crisis scares people away and they never come back

Then it seems IIS adoption is acting as a Microsoft innoculation. A little IIS is introduced into an organisation, an infection flares up, and management now know how to respond to anybody who suggests using Microsoft software on servers. I honestly never thought I'd ever draw an analogy where PHBs are white blood cells.

Re:The war on the web server front

[lowe0]

While I'll agree that IIS' security record is worse than Apache's, you're missing a motivating factor for hackers.

It's not always about bringing down big, popular sites - sometimes it's about bringing down big companies. Every hacker knows that they'll get front-page coverage for a major attack on Microsoft products.

On top of that, there's a great deal of irrational hatred of Microsoft among technically inclined individuals, which would motivate attacks on them.

So, while I'm not about to take even the majority of the blame away from MS on this one, you disregard a significant motive for hackers.

Re:The war on the web server front

[AJWM]

there's a great deal of irrational hatred of Microsoft among technically inclined individuals,

Really? Technically inclined individuals tend to look at things with a logical, rational approach. Most non-technically inclined individuals tend not to understand the technically inclined.

Therefore, it's more likely that technically inclined individuals have a rational hatred of Microsoft, but most people are lacking sufficient clue to understand why.

As for crackers and script kiddies, yeah, there's something irrational about their thought processes (if any).

Re:The war on the web server front

[the quick brown fox]

Very insightful post!

Lots of ISPs use Apache, because it's free, easier to configure in a scripted fashion, and generally all around more suitable for a hosting setup.

I also understand that any survey that counts domains is going to be heavily skewed by the big domain name registries that have default parking pages. Every once in a while an article comes up on News.com that mentions this. (1, 2)

Re:The war on the web server front

[aldoman]

I agree.

I see many articles on 'Apache is less insecure because more sites got hacked with it on'. This is BS, because probably most of those sites were running insecure code (ie, passing $_GET straight into a exec() call or something as stupid).

Compared with IIS, where a bit of the good ol' ../../ seems to give you root access far too often.

Re:The war on the web server front

[spectecjr]

Really? Technically inclined individuals tend to look at things with a logical, rational approach. Most non-technically inclined individuals tend not to understand the technically inclined.

Therefore, it's more likely that technically inclined individuals have a rational hatred of Microsoft, but most people are lacking sufficient clue to understand why.

Vi vs. Emacs.

This is not a technical debate.

It's a religious war.

Technically inclined individuals - regardless of intelligence - are as likely to get into stupid petty religious wars as any other individual. So no, they are not likely to have a rational hatred of Microsoft. No matter how much your bias makes you want to think that they should.

Re:The war on the web server front

[phiwum]

Really? Technically inclined individuals tend to look at things with a logical, rational approach. Most non-technically inclined individuals tend not to understand the technically inclined.

Therefore, it's more likely that technically inclined individuals have a rational hatred of Microsoft, but most people are lacking sufficient clue to understand why.


You're gratuitously flattering your readers and yourself. The idea that the "technically inclined" are dispassionate and logical when it comes to technical issues is a touch doubtful.

(Note: I'm not agreeing with the original poster that the dislike of MS is irrational.)

Re:The war on the web server front

[Khazunga]

Netcraft lists Alexa Top 10 as running:

1. Yahoo.com: Unknown (Given what leaks from the technologies used, I'd bet its Unix)
2. MSN: Windows and FreeBSD
3. www.sina.com.cn: FreeBSD
4. google.com: Linux
5. sohu.com: Unix variant
6. 163.com: FreeBSD
7. baidu.com: Linux
8. 3721.com: FreeBSD
9. yahoo.co.jp: FreeBSD
10. passport.net: Windows

You recognize yourself that Linux/*BSD take the bottom part of the market. This clearly demonstrates Linux/*BSD taking also the top part of the market. I won't deny there are many company websites on IIS, but they are much much less than what you seem to think. And every Code Red Worm-alike eat away at that marketshare.

IIS is an also-ran.

Re:The war on the web server front

[_Sprocket_]

It's not always about bringing down big, popular sites - sometimes it's about bringing down big companies. Every hacker knows that they'll get front-page coverage for a major attack on Microsoft products.

There is certainly a motivation out there to tweak Microsoft. Something along the lines of "If the arrogant jerks' products are as good as they say they are, how come I can do this?" kind of mentality.

But at the same time, you're ignoring the traditional and still very popular motivation: resources. Compromising a host is more often than not about gaining access to some resource. It could be for bandwidth and drive space for hosting illicit data. It could be running your IRC bot from army.mil or nasa.gov IP space. These days its more common that resource is a zombie for a DoSnet or a SPAMnet.

For a long time, gaining resources meant attacking a Unix host. Unix admins went through that crucible and Unix systems started hardening up. But now, why bother attacking it? Unless you have a specific interest in what's available to a Unix host (and there are some that do), most general resource requirements are available from the low-hanging Windows fruit.

On top of that, there's a great deal of irrational hatred of Microsoft among technically inclined individuals, which would motivate attacks on them.

Sure. There's irrational hatred. I've met people like that. They spout about Evil Microsoft and when asked why they feel that way, they have a hard time really coming up with an explanation.

That doesn't mean all Microsoft "hatred" is irrational. I've also know quite a few people who have a very strong aversion to Microsoft who can also explain very clearly why. Whether you agree or not is one thing. But they are certainly rational about it.

Re:The war on the web server front

[AJWM]

That's why I couched it in terms of "tend to" and "more likely".

As far as technical issues go, the not technically inclined are unlikely to have any opinion at all (other than an aversion to having to learn something new), so the comparison is moot.

To my mind "irrational hatred" is something like what, say, a Denver Broncos fan might have for the Oakland Raiders (or pick any other pro sports intense rivalry).

Re:The war on the web server front

[phiwum]

To my mind "irrational hatred" is something like what, say, a Denver Broncos fan might have for the Oakland Raiders (or pick any other pro sports intense rivalry).

Well, I guess I agreed with your reply up until this point.

Even here, you're mostly right until the parenthetical remark. I mean Broncos, Raiders, who cares?

But the Philadelphia Flyers are simply evil. Ain't no questions.

(A Pittsburgh fan, despite their last two seasons)

WTF??!

[Anonymous Coward]

(posted anonymously, so my karma doesn't suffer EVEN MORE)

Does someone have something against me, or something?

Holy @#$*(. TWICE in TWO DAYS a perfectly legitimate comment is modded down..

Consider this:
my comment.. flamebait
this comment (http://it.slashdot.org/comments.pl?sid=124766&cid =10461007) which says EXACTLY THE SAME THING...
+5 interesting

WTF??!

Man!

[Lobo]

Screw talking about fixing it.
I want to know all the pr0n sites still vunerable!

Your example doesn't make sense

[DunbarTheInept]

Firefox is a browser. If a web server is allowing access to a file on the server that it shouldn't, then that's isn't a bug in Firefox - it's a bug in the web server. Any server that is dependant on the client playing nice in order to get proper security (like most online games) is broken by design.

Good, Fast, Cheap

[jerometremblay]

Choose any two.

Best course of action, but

[RoboProg]

It still sucks for the economy to be out 8.7 million hours.

It sounds like, as far as I can guess, that the order of operations chose by MS was:

1) run "security validation" (?) on URL
2) convert URL into canonical form

rather than

1) convert URL into canonical form
2) run "security validation" on URL (to see if you have rights to the resource referenced)

I don't know how they could accurately identify what resource the incoming URL referenced, and not catch your lack-of-privelidge to access it.

I think it is part of our job to continually remind our bosses what presumtive ("we're number one, so we don't have to care!") twits MS can be, and question just how wise it is to trust your livelihood to these folks.

But that's just my opinion. :-)

Where is cleopatra when you need her?

[slashname3]

You just knew something called ASP would have to come back and bite them in the butt some day. Didn't you? :)

This is news?!?

[BlueUnderwear]

What's next: "The cat catches mice" "The pope is catholic" "There were no weapons of mass destruction in Iraq" "Water wets"?

I have news for you: 1 password-protected ASP application out of 3 can be accessed using the username ' or ''='' or ''=' and the empty password (the first and last single quote are part of the username).

Reason: SQL injection.

Supposedly these apps verify the password via a construct equivalent to the following (pseudo-syntax, I don't know enough VB to write real code):

answer = query_execute("SELECT account_id FROM users WHERE username=' "+username+" ' AND password=' "+password+" '");

Yes, they use string concatenation to build the query, rather than using wildcards (bind variables)! Not sure ASP even supports wildcards...

What happens with the magic username above, is that a query such as the following is executed against the database:

SELECT account_id FROM users WHERE username='' or ''='' or ''='' AND password=''

(the part of the query coming from the user-entered data is bold, the rest is what came from the program). This is a query that matches for all rows, so you'll usually get connected using the credentials from the first account in the table (often administrator, he!). Try it out! Go to google, seach for login asp username password and pick one of the sites from "the middle of the stack" (i.e. not from the first few pages returned, because those are mostly either ASP tutorials, or the rare "secure" ASP sites). Saying username and password in another language (Benutzername/Passwort) helps too as you'll get a "fresher" less overfished list ;-)

If the simplistic approach doesn't work, try entering a lone single quote as the username and/or password. You'll often get an error message that shows you part of the query used, and from there you can find how to word your username so that you still get access. For instance, some sites do not use the password in the WHERE clause, but instead return it. In that case, use something such as the following as your username, and zozo as the password:

' union select 0,'zozo' from users where ''='

The query obviously neads some tweaking, as the number of columns, position of password in select clause, and names of table obviously varies among sites. But fortunately, error messages are often verbose enough that with a little bit of trial and error you can figure out a "magic" username that opens the door to the kingdom.

If you are a site administrator whose app is vulnerable: rewriting your app is indeed a solution... preferably in PHP!

Re:This is news?!?

[reverendslappy]

Somebody mod parent down. More ASP.NET FUD.

The scenario above is true. But I have news for you: SQL injection attacks work with more than ASP.NET. Even <gasp> PHP. Anyone who's dumb or lazy enough to dynamically build queries based on user input and still doesn't -- at least -- execute some serious validation of the input should be fired. Period. And it's not hard. A simple regular expression can prevent injection attacks. Also, using parameterized stored procedures (which is quite easy with ASP/ADO.NET) adds a second layer of protection that avoids the vulnerability altogether.

Also, the threat is a lot more serious than you describe. You can do a whole lot more than gain access to a protected site. There's nothing to stop anyone from doing like

' go drop table tbl_whatever go --

If the account used to connect to the DB has sufficient permissions, bye bye table (obviously you'd have to know the name or iterate through them in sysobjects).

Ultimately though, this has ZERO to do with ASP.NET, but has everything to do with the person who developed the specific app. If you have an unchecked input that winds up being executed against the DB, you're screwed no matter what language you write it in. And I'd really like to know where exactly you got the 1 in 3 figure. I'm guessing somewhere near the end of your digestive system.

So, if you are a site administrator whose app is vulnerable (be it written in ASP.NET, ASP, PHP, whatever), rewriting your app in a different language isn't indeed a necessary solution. You can ignore the FUD above and simply hire a real developer to add some simple input validation and make the DB access a little smarter, and you're set.

Re:This is news?!?

[spongman]

sure, but this is true for ANY language that can make SQL calls.

Microsoft repeatedly states in the documentation that it's better to use parameters on a command object for two reasons:

• security. exactly what you say above.
• performance. if the database has a cached copy of the parameterized query then it doesn't need to do the compilation. (however, sql server 2000 does have the ability to infer the parameterization of ad-hoc queries in order to avoid recompilation, but it's still more expensive than using a cached command).

the bottom line is: no developer worth his paycheck should be using ad-hoc queries, and those that get paid enough to eat should be using stored procedures anyway.

Secure web app stuff?

[rikkus-x]

Is there any web app framework which has never had a security hole? I'd love to use it, if there is. Any pointers?

Rik

Can't reproduce....

[Psychotext]

Probably too late in the discussion for anyone to see this, but I can't seem to get this to work on my apps / server. Lets say I have this:

www.domain.com/securebit/securefile.aspx

which redirects to:

www.domain.com/login/login.aspx

I've tried replacing / with \ or %5C in the bit before "securefile" but it just doesn't work for me. I'm using forms authentication with role based permissions. Webconfig that handles this is (simplified):

<location path="securebit" >
<system.web>
<authorization>
<allow roles="Client" />
<deny users="*" />
</authorization>
</system.web>
</location>

That's not exactly right but it gives a good idea. I also have parent paths disabled, which I've been reading may or may not have an effect on this exploit. Have made the changes recommended already but I would really like to see if I can repeat the flaw on a testing server (Even if just to cover my ass with the customers!).

Re:The two faces - MOD PARENT UP!!

[_Sprocket_]

This sensationalism is fine if /. wants to be a tabloid, but the fact that it is so one-sided against MS makes /. more of a shill.

I'm all for keeping Microsoft's critics honest. And I welcome debate and dissenting opinion. But let's not act all shocked and surprised at the general negative attitude towards Microsoft found in this forum; it's always been there. And, frankly, it's a welcomed change from the usual positive Microsoft bias common to so much of the press-release-as-a-news-story industry media.

Why why why

[bogie]

Do people still come to /. one of the major Linux and OSS hubs on the Internet and expect pro-MS reporting? Can you explain that to me? Do you think Linux users got to Paul Thurrott's SuperSite for Windows expecting pro-Linux reporting? No they don't.

Maybe when we can go a finally go a few months without a horrific finanically devasting virus or security flaw in Windows being reported, then we will give MS a second chance. Until then you'll excuse us if we don't give Microsoft the benefit of the doubt. Especially when you consider their past and current efforts to wipe Linux and OSS from the face of the planet and how they put out major Press Releases where they LIE about Linux on a weekly basis.

See here you are getting pissed off that an anonymous poster used the word "re-write" which btw is techincally correctly. Compare that to the garbage MS puts out constantly about Linux which reaches CEO's, the media, and sites likely to be read by management(as opposed to /.). Now you tell me which is worse and does more damage via FUD?

Sincerely

typical anti-MS slashdotter truth-teller

Attention Internet Shoppers

[HangingChad]

For the next four hours we will be featuring FREE P0RN at all adult ASP.NET sites. This value added bonus is brought to you by MSFT: Where do you want to jerk off today?

Total impact for 5 sites: 15 minutes (so far)

[Vic Metcalfe]

I tested the 5 sites I've used this feature on over the last couple of years. Out of those 5 sites, only one proved to be vulnerable. I didn't take the time to find any pattern. None was obvious.

The test took about 10 minutes. Then I applied the work-around from MS, and uploaded that to the server. That took about a minute. Then I tested the site in question, ensured that the hole was closed and the site still functioned correctly. The site isn't too complicated, so that took less than 5 minutes.

So the total impact to me so far was less than the time spent reading the replies to this post on slashdot!

That said, I agree that an open source solution where a patch could be released right away would have been much better.

Right, so does this mean

[Bertie]

I'll be able to get into porn sites by the, er, back door?

Re:'Just a patch' is something of a misnomer Reall

[Nom du Keyboard]

Why do I write in ASP.NET? It is FAST

But is it really fast, when you have to deal with problems like these?

It's like saying I own a really fast car, but it's in the shop a lot. Is that still the best car for you?

some banks do...

[mgkimsal2]

Funny you say that. I was recently working at a bank that was using PHP for all front end and middleware stuff. The 'bank' code itself (which calculated interest and all that jazz) was Oracle and thousands of stored procedures and triggers, but everything else was in PHP. A large contingent of PHP people left at the same time, however, so I'm not sure they'll stick with PHP long term, but that's a business/resource issue, not a technology issue. PHP can talk SOAP to external systems as well as .net or java, which is mostly what was required for that type of system.

Re:The two faces - MOD PARENT UP!!

[Megaweapon]

And, frankly, it's a welcomed change from the usual positive Microsoft bias common to so much of the press-release-as-a-news-story industry media.

So instead of the glossy MS corporate spin you welcome fanatical, bash-MS-no-matter-what spin?

And...

[jav1231]

Microsoft: "And those 2.9 million web sites running on ASP.NET are just as secure as those run on Apache!"

Microsoft's attacks on Unix/Linux caused this

[spitzak]

Microsoft actively encourages use of backslashes in URL's in their Web publishing software. This is done so that it is more difficult to move a web site to a non-Windows server, and also to break older non-IE browsers by making them fail to correctly parse relative URL names.

If they had written this correctly, IIS would, at a very low level, have checked any URL and translated it to a legal Windows filename. This would mean turning any backslash into some other escape sequence before using it to identify the file in the file system (forward slashes could be left alone). This would have been trivial and in fact most original 3rd-party software for serving web pages from Windows did this. This would have immediately stopped the exploit of putting '\' or %5c into the URL.

IIS certainly checks and cooks the URL in many other ways before producing the filename, so lazyness is not an excuse. It is pretty obvious that they wanted to intentionally allow URL's on the web that were non standard and would not work correctly on Unix servers.

Can anyone actually replicate this issue?

[CampbellXL]

As an ASP.net developer this concerns me, however I've been trying to bypass both Windows and Forms Authentication security (supposedly both succeptable) using the methods described in both Firefox and IE and all it does is just forward me to the login page. I'm also running a fully patched Win2k3 IIS6 box so maybe this is an issue for those behind on their updates? Either that or it's just much ado about nothing.

Re:Can anyone actually replicate this issue?

[poupou]

It cannot be reproduced (sample code found on the internet) with W2K3 ( actually IIS 6). However MS warns that all OS are affected including W2K3, so the sample may be incomplete.

Workaround Incorrect

[esolu]

I'm relatvively sure that canonicalization happens before application_beginrequest. A simple debug will show you that your requested URL has already changed to an appropriate forward slash.

Good point. But the post is flawed...

[kosmosik]

Actually this case is very good argument pro Open Source software. Too bad the /. post is flawed. It is perfectly OK that they state - we don't have a patch right now: you can:

1] Lay down the service and wait for patch.
2] Do a workaround the problem with scripts.

The case is not about the workaround as it is obvious that it is better than lay entire service. The case is about that there is no other option. You just have to wait for the patch (we'll se MSFT timing on that).

With Open Source you can:

1] Lay down the service and wait for distributor to issue patch/update.
2] Take the patch from somwhere else and apply it (on source code) yourself.
3] Make a workaround.
4] Pound through source code and fix it yourself (probably with help of entire community) - which often can be easier than issuing workarounds (depends on scale of your systems).

See? You have more options. Not just sit and wait you can actually do something. This flaw is much critical - it will be fixed soon. But I know MSFT not fixing flaw that caused system crashes like every 15 min. for 2,5 year just because it was flaw in something that was not widely used (but was important to me f.e.).

Take look at this KB:
http://support.microsoft.com/default.aspx?sci d=kb; en-us;319810
It says it was fixed in June 1, 2002 - than consider that this hardware (and Windows version) was aviable and used in late 1999 which gives 2,5 year of not fixing unstable system. Congratulations.

Sponsorship!

[Spy der Mann]

It doesn't matter if your framework / server is the MOST VULNERABLE SOFTWARE EVER WRITTEN ON EARTH.

As long as you have money, you can make companies buy your product!

Details from the Internet Storm Center

[I)_MaLaClYpSe_(I]

Microsoft announced a possible vulnerability in ASP.NET (www.microsoft.com/security/incident/aspnet.mspx).
There are not much details so far, but it refers to the "canonicalization" functionality and suggest to implement then hardening measures outlined in KB887459 (support.microsoft.com/?kbid=887459).

It appears that a particularly crafted request may confuse ASP.Net and allow access to otherwise protected directories.

If a web server receives a request for a particular URL (e.g._http://server/somedirectory/filename), the 'somedirectory/filename' part has to be mapped to a particular file located on the server. This translation has been the source of many "directory traversal" bugs. The IIS unicode exploit is probably the most famous one.

After our original posting of this diary, a few users pointed to the following articles which provide more details then provided by Microsoft's advisory:
(Thanks to Chaouki & Daniel)

www.heise.de/security/news/meldung/51730 (german)
http://www.derkeiler.com/Mailing-Lists/NT-Bugtraq/ 2004-09/0068.html
blogs.devleap.com/rob/archive/2004/10/02/1803.aspx (italian)
www.k-otik.com/news/10052004.ASPNETFlaw.php (french)

It appears that by switching a '/' character in the URL with '\' or '%5C', the canonicalization routine will be confused. So if the URL: http://www.example.com/secure/file.apx is password protected, using the either of the following URLs will bypass the restriction: http://www.example.com/secure\file.apx http://www.example.com/secure%5Cfile.apx

In addition to the slash/back-slash confusion, one reader reports that inserting a space will bypass the URL restriction as well: http://www.example.com/%20/secure/file.apx (had no chance to validate this method so far)

URL Obfuscation

Handler and star SANS instructor Ed Skoudis compiled a comprehensive list of various URL obfuscation methods used in phishing schemes and spam. Some of these methods do not work with all browsers (e.g. the %01 issue in older Internet Explorer versions). In order to preserve the tricky details of some of these methods, we setup a page which includes just the URL methods without our usual header and footer:isc.sans.org/presentations/urlobfuscation.p hp (to view as source: isc.sans.org/presentations/urlobfuscation.txt ).

Jan Reilink wrote to point us to this page with more details about URL obfuscation and decoding:www.pc-help.org/obscure.htm .

Re:The two faces - MOD PARENT UP!!

[_Sprocket_]

No. I appreciate the bias that is willing to point out not everything lines up with that glossy corporate spin. And, as I pointed out, I also welcome the criticism of that criticism that keeps the negative MS bias honest.

I have to wonder - did you even READ what I wrote? Or were you too eager to paint me as a fanatical zealot because my implied identification with Microsoft's critics?

Re:'Just a patch' is something of a misnomer Reall

[Anonymous Coward]

More like, "I have a really fast car, but it slams into a wall once a week or so, killing everyone aboard."

Re:'Just a patch' is something of a misnomer Reall

[wils0n]

I don't think that's the kind of "FAST" he was writing about.

And your analogy is teh lame. All race cars are in the shop a lot. If I am at the races, yes, it is the best car for me.

Scalability

[Spy der Mann]

Hey. You forgot something. Scalability is about "nothing shared". You can rewrite PHP's session functions to use files on a remote server. Wanna scale MySQL? Just change the MySQL server's address. Yeah it involves rewriting some stuff, but it CAN be done.

Now, talk about bandwidth usage? Use a compiling/caching template engine. <--- this is usually the most troublesome thing in web servers.

Oh, and remember PHP 5 is ALREADY out if you're concerned about performance issues.

Re:Total impact for 5 sites: 15 minutes (so far)

[GSloop]

I've posted this elsewhere, but I think this is a great example.

I strongly suspect that you only *think* you've fixed the problem, not really fixed the problem.

But, don't trust me, go read the MS KB article. It's pretty clear to me that the "work-around" is likely to only be a partial fix. They reference "help," not fix numerous times.

When such a huge bug exists in the underlying system, a simple work around isn't likely to plug much more than the obvious holes.

IMHO, provided I'm right, this is worse than no solution at all. The admin's think "All is well - I patched that." and tune out all the warnings. But the reality is that you patched 5% of the problem, and now have a complete false sense of security.

I hope I'm wrong, but I suspect not.

Cheers,
Greg

Re:'Just a patch' is something of a misnomer Reall

[JakeisBland]

Yeah, maybe it's your logic, tool.

Re:The two faces - MOD PARENT UP!!

[Megaweapon]

I never painted you as a fanatical zealot. I'm simply saying that a bit of the "general negative attitude" (as you said) in this forum is over-inflated idiocy (particularly by the editors). Sure, there is plenty of reason to not like MS, but having editors and posters misrepresent things like the impact of security issues isn't the way to properly discuss things. Couple that with the odd twist of this forum embracing games that are typically Win32 only (The Sims series, etc) just shows that Slashdot can't be seen as a level-headed discussion forum.

5-line patch is a code-word for...

[Anonymous Coward]

...2 weeks of QA testing and deployment in production.

Maybe its not a big deal to some of you kids who think you can code a patch and have it in production that day because MS said so.

To the rest of us, you have to test the thing thoughly because the business's revenue comes through that site.

Re:Total impact for 5 sites: 15 minutes (so far)

[Vic Metcalfe]

You may be right, or they may just be hedging since the fix was probably released in haste and probably wasn't fully tested.

I do know that before applying the fix I was able to bypass the authentication with the %5c trick, and now I cannot. I will keep my eye on the issue!

BTW, I realized an obvious pattern to which sites were not vulnerable. I'm hosting them all on my own box with IISLockdown installed. The vulnerable site is hosted elsewhere and I don't know if they've installed IISLockdown or not.

404'ed!

[Spy der Mann]

How curious. This is exactly how i stealth my forbidden directories in my PHP apps, by using the .htaccess file.

RewriteEngine on
RewriteRule .* [R=404]

The hacker will never know when he's found a forbidden dir.

I could as well use a prepend.php and put a 404 redirect in there.

Still, the difference is that with this I *enhance* the security in my site. Very different thing is letting people access pw-protected directories with a simple url rewrite.

READY, GO!

[phrostie]

everyone start your Offical CTO Stop watches.

Re:'Just a patch' is something of a misnomer Reall

[NotClever]

There different domains. One is speed of development and maintenance, one is speed of execution. I believe he was referring to speed of execution...

bah!

[dougnaka]

there's no such thing!

Re:The two faces - MOD PARENT UP!!

[Frizzle Fry]

But let's not act all shocked and surprised at the general negative attitude towards Microsoft found in this forum; it's always been there.

People aren't shocked and suprised at the general attitude of the forum participants. They are offended at the bias and deception in the writeup posted on the frontpage. Yes, it was submitted by an "anonymous reader", but the editor posting it (michael in this case) should take some responsibility for confirming that the story he posts is not completely false or misleading. Biased comments in the discussion are expected. That's why it's a discussion. But the "news" should be made to be at least a bit accurate.

Maybe I'm a bit more concerned about these issues right now than I usually am because last night I watched the excellent documentary outfoxed about the propaganda that the Fox News channel passes off as news.

Mono instead of Microsoft runtime

[anglete]

Does this affect people who use Mono instead of microsoft as the back end?

It seems that making the backend run mono instead of microsoft is a viable solution for small scale ASP users.

Oops, correction to parent post

[Zinho]

s/apathetic software distributor.*\./apathetic Free Software Community./

You can't pull this trick if you don't have the source code and the right to modify it for your own use.

Yes and? That is the way it works on unix too

[SmallFurryCreature]

Your example line is perfectly correct and unix works like that too, minus the c:\ crap bit replace it with the root /

../../../../home and /home are (on my setup the same directory. The root .. just points back to the the / dir. So you can do as many ../ as you want. Try it.

Not sure if the same is true on dos but it should be else you could go some place weird just by doing a cd .. to many.

Here's the link to the BugTraq Article

[xxxJonBoyxxx]

Here's the link to the September 14 BugTraq Article

http://www.ntbugtraq.com/default.asp?pid=36&sid=1& A2=ind0409&L=ntbugtraq&F=P&S=&P=98 84

Um..

[CaptainSuperBoy]

Because it blows? PHP really, really blows. OK finally, after years it's "object oriented" even though the function library is still a haphazardly-named mess of handles and global variables.

Bullshit, it's got to be a PITA.

[twitter]

All thats required is a couple of lines in Global.asax. Thats hardly a rewrite.

That sounds like a fix to me. Why provide a "guideline" when a fix is available? While the the name implies modularity, the Microsoft code samples show otherwise. It looks like a rewrite of code, written to previous guidelines, is required so that your code will then point to that file because the previous "easy" method was so easy to defeat. Think about it for one instant and you will realize that an easy, global fix would be pushed out by Windoze Update and no fuss would be made.

The ominous portion of the warning is that "administrative" areas were also protected by the same scheme. That makes sitting ducks out of every one of the 2.9 million sites dumb enough to trust M$ with security.

Re:Bullshit, it's got to be a PITA.

[The Bungi]

Ho would you push an update to a text file (code at that) through "Windoze Update", oh Master Developer Guru. Please enlighten us.

Can't replicate?

[delus10n0]

I've been unable to replicate this behavior on any of my own projects/sites.. does anyone have detailed instructions?

Really that easy?

[twitter]

If a small change to a single file is all that's required, why all the fuss? Why didn't M$ just push it out with Windoze Update?

"Doomsday talk" is about how this flaw lets people into your "administrative" site. Want to imagine how many .NET programmers are going to miss this little talk and have their servers used with ease by any old deviant?

P.S. - I am not a microsoft supporter

I'm Glad you let us know!

Re:Really that easy?

[DJ-Dodger]

It is an easy fix, but it isn't a file that Microsoft can just overwrite because it can be filled with custom code. Many smaller application don't have a speck of code in global.asax, but many more complicated applications have all sorts of code in there to respond to global events (Session Start, Session End, Application Start, etc.)

The lines above are adding a check to the Application_BeginRequest event handler that checks for certain bad characters and throws a 404 "not found" http error back if the requested url does contain those characters.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Asp.net is free

[ad0gg]

Uh.. Asp.net is free, they don't charge for it. Download the free SDK. No where does microsoft charge for asp.net.

SDK Download

Re:Asp.net is free

[lordlod]

It is impossible to host an ASP.NET site without paying microsoft. Even if you don't pay them for the SDK they still get their money.

Re:Asp.net is free

[CausticPuppy]

It is impossible to host an ASP.NET site without paying microsoft. Even if you don't pay them for the SDK they still get their money.

I beg to differ.

Re:Asp.net is free

[abandonment]

yup, downloading an SDK for free - sure

what platforms does it run under? the microsoft version of 'cross-platform' - ie anything microsoft.

gee, looks like microsoft still gets their 'tax'...

Re:Er, yea.

[shiflett]

And anyone who thinks PHP is a pillar of security obvious hasen't used PHP all that much.

It's difficult to argue that anything is a pillar of security, but those who buy into the myth that PHP is insecure are the ones who haven't used PHP that much, not the other way around.

Hmm, actually, no.

[adolfojp]

The only viable choice to ASP.NET is Java (a mix of JSP, Servelets, Beans, Enterprise Beans, JSF and perhaps Struts).

Never mix apples and oranges... except if you are making a cocktail.

Cheers,

Adolfo

Before we start the Microsoft = bad trolls.

[adolfojp]

1. The suggested fix is small and simple. A couple of lines in the Global.asax file is harldy a rewrite. You probably wont need more than a couple of minutes to do it.

2. Open source alternatives are not flawless or bug proof.

3. ASP.NET has an excellent track record and it is on a league of its own. Well, except for perhaps Java.

Bashing anything Microsoft won't make you automatically cool, although it helps ;-).


Cheers,

Adolfo

To Quote Tarantino in Pulp Fiction...

[16K Ram Pack]

Jimmy: "When you came posting security alerts, did you see a sign over my desk that said Large Software Firms Webserver Bug Resolution Team?" Microsoft: "Jimmy, you know..." Jimmy: "Did you see a sign over my desk that said Large Software Firms Webserver Bug Resolution Team?" Microsoft: "No. I didn't". Jimmy: "You know why you didn't see that sign?" Microsoft: "Why?" Jimmy: "Cause it ain't there. Because fixing Large Software Firms Webserver Bugs ain't my fscking business"

What's this error about?

[16K Ram Pack]

Does this have anything to do with roles, or is it just to do with where folders have been protected at more of a "web server" level?

I support a web application, and it uses Role-Based authentication, database and cookies to store/process the roles (you have probably seen articles with such a thing)

Am I safe, or is this system affected (rather not have to do some unpaid work to fix Microsoft's fault if not really necessary).

And what irritates me the most...

[theolein]

I can understand full well why Apple zealots are hated (I use a Mac myself btw,) because I am starting to get so pissed off with Microsoft fans getting on the fucking defensive and ranting and raving at slashdot, once again, everytime a MS security bug crops up here or when MS does yet another crazy business action.

For crying out loud, if you are so blind that you can't see that
A) slashdot, in general favours Linux and opensource products, and
B) slashdot does actually post interesting article on MS every now and again when MS really does innovate, then...

fuck off back to Winsupersite where Paul "I sold my butthole to Bill" Thurrot will be glad to have you.

Or are you drawn to this site because its actually interesting?

Re:The two faces - MOD PARENT UP!!

[_Sprocket_]

I'm simply saying that a bit of the "general negative attitude" (as you said) in this forum is over-inflated idiocy (particularly by the editors). Sure, there is plenty of reason to not like MS, but having editors and posters misrepresent things like the impact of security issues isn't the way to properly discuss things.

Fair enough. I also agree that the negative outlook is taken too far at times. There are criticisms that I've disagreed with. I'm just wary that all criticism is being discarded.

An interesting aspect about Slashdot is that it really isn't a traditional news outlet. Slashdot does not provide news itself but points to a news source and then provides a forum to discuss that news. As such, that discussion is int regal to Slashdot and the opinion expressed in the initial entry is of limited importance.

Traditional media re-packages an opinion and provides no ability for feedback. Or the feedback mechanism is an after-thought or an apparent ploy to push banner ads.

Again, I'm not defending the more outrageous behavior. But at the same time, I'm not keen to lambaste the entire forum for that behavior.

Couple that with the odd twist of this forum embracing games that are typically Win32 only (The Sims series, etc) just shows that Slashdot can't be seen as a level-headed discussion forum.

Slashdot has come to reflect a large group with differing interests. Some people like Win32 games. Some people like Anime. Some people take very polarized views of US politics and policies (discussed on the new political section). There are critics and dissenting opinion on all these subjects. So you are not going to find complete consistency across the board. And you don't have to favor one topic to support another.

Having said that, I'm looking forward to when more and more of the game discussed aren't Win32-only games.

No way!

[hazah]

A flaw? MS, you dissapoint me.

Re:Total impact for 5 sites: 15 minutes (so far)

[Johnno74]

Ahh, good thinking, IISLockdown probably would block this - the URLScan component probably translates the \ in the url back to a / before .Net sees it.

I couldn't replicate this problem on my local machine here tho, which doesn't have IISLockdown or URLscan installed. I created a basic website with a couple of pages + a login page, using forms auth, with the login redirect in web config pointing at the login page. Goint directly to http://server/vdir\samplepage.aspx (in moz) or http://server/vdir%5Csamplepage.aspx still redirects me to the login page.
How did you replicate this?
Cheers

Re:'Just a patch' is something of a misnomer Reall

[myowntrueself]

Yeah but when you need to squeeze every ounce of performance out of a 2GHz processor you will be glad you chose ASP.NET

And not to mention when you need to squeeze your application into a mere 2 gigs of RAM.

;)

update posted

[sseveran1]

Brian Goldfarb who is a program manager for ASP.NET today posted a link to a http handler that will block requests using malformed URLs for all web apps on the server. Link I think this is a bit overblown here. URLscan which is recommended in any MS security blocks this. The ASP.NET security guide shows how to avoid cannonicalization issues. On the other hand how did this get through testing? .NET has an excellent security track record with very. very few issues. I think that this is the first major one. Good for something as large as .NET. MS has come a long way over the last couple of years with security. Best of luck to them over there. More info can also be found here.

Re:Total impact for 5 sites: 15 minutes (so far)

[Vic Metcalfe]

I wish I could tell you how I replicated this! At first I was just thinking about the code. My first thought was authentication against a database vs against values in the web.config, but that was proven wrong. In the end, the only thing I could come up with was that my server is hardened with IISLockdown, which does pre-process URL's before they hit the webapp layer. That said, I've found some sites even on my local IIS under XP which isn't hardened with IISLockdown aren't vulnerable, so I don't know what the secrets of this trick are.

Non-billable?

[initialE]

Just curious, but why can't you bill for these hours? The flaws were no fault of yours, and you don't have to bear the consequences of every flaw of every Microsoft product - otherwise you'd be providing support for free until the day you die.

come come commala

So Microsoft sucks LESS than Ford?

[skyhawker]

That's your argument? They both suck, but Ford sucks more? How does this address the responsibility that Microsoft should have for making its products perform correctly? Sheesh -- you Microsoft apologists are just too much.

Re:So Microsoft sucks LESS than Ford?

[Pieroxy]

You are either incredibly stupid or just didn't read my post.

That's your argument?
That is my answer to the parent post.
They both suck, but Ford sucks more?
I stated that and illustrated it. What is there more to say?
How does this address the responsibility that Microsoft should have for making its products perform correctly?
It does not. What makes you think that it was my point? I am replying to AC who stated in substance: "MS sucks, if it would have been for a car company, they wouldn't have sucked like that". So I just replied that yes, they actually do suck more than that.
There was no other point to my post.
Sheesh -- you Microsoft apologists are just too much.
Your own misunderstanding of my post is simply blinding you here, I think. I am not a Microsoft apologist by any means.

Your apologies are accepted however ;-)

My Hopes

[seancallaway]

I really hope that this becomes a case-study for the open source movement. Could you imagine the guys at Apache saying "We've found a bug that lets a user access your system" WITHOUT releasing a patch? And the guys at Microsoft get _paid_ to fix these problems. Sheesh!

Nah

[Aquila Deus]

Any bug in mozilla firefox can't be serious because nobody is using it...

You get what you pay for ... NOT !

[Gopal.V]

> When Microsoft fouls up, we all get mad because we've maybe paid too much money for the product/license to begin with so we believe it should function better than a free solution. Sadly the opposite is often more true!

I've seen the "You Get What You Pay For" attitude work the wrong way for most managers who have no idea about the technology involved . Sadly this includes the hidden costs as well - Unix was high-tech because it needed an admin who pulled half that of the CEO , recently it's been "only Damn commie hippies use Leenux" (with apologies to RMS) . This is true to the survival of Technical Primadonnas as well as Microsoft's products. Foe example my project uses Redhat 9.0 - because that's what the IT guys paid for , what they don't know is that the servers run on a gentoo chroot on the same box (compiled with everything but) .

The difference with the Perl solution is very simple, they put out a new release or patch. A patch I can read, inspect and understand , maybe even adapt a little so that my product works. It's not like put these bits here and those bytes there and the binaries are patched.

The great thing about FOSS is that bad code never lives long . Of course that's the difference between a successful project and an unsuccessful one :).

Look more at the origins of both

[Gopal.V]

Linux comes from a tech-savvy community who enjoy making fun of and exploiting bad code/design by others (yeah, some are Elitist Bastards .. but that comes with the territory).

Windows comes from a company that believes in making money and releasing on particular dates , not to mention interested in selling updates as well.

Which one do you think will be more secure ?. Do I decide because it's been hacked by the hackers (white hats rule !) or because it passed an agressive regression test cycle written by incompetent morons who are more interested in the money ?.

A few years back (waaay back in '99) when I first encountered GNU/Linux (my first guru is now a board member of FSF India) , the system was frayed round the edges and center . But 4 years down the line with Suse and IBM cracking down on the quality factor - the tide is turning. Both of them have a regression test suite and quality control for the PHB perspective - but Microsoft too has people poking holes in it (unfortunately those are not white hats).

All that said - if Linux wasn't GPL , we'd have 10 forks each calling IBMLinux, FreeLinux , OpenLinux, DragonflyLinux ... each working on different directions to do the same thing (and I'm not talking about just package managers). (Much as I approve of the BSD attitude, it doesn't translate well into a commercial scenario, unlike GPL'd stuff).

Re:The "Ominous" bullshit

[hesiod]

> you think it's a coincidence that, surprise surprise, their "tech news" site posts articles critical of their competitors? Come on, open your eyes.

Open your eyes to the truth instead of mindless conspiracies. /. had all these articles with the same slant before OSDN came around sniffing.

IIS 6 Not Affected

[Bandit0013]

The code "rewrite" is 5 lines.

If you actually used the IIS Lockdown tool in IIS 5 you won't be affected either.

So once again this is slashdot blowing something way out of proportion. If you're running the latest server software (IIS6, W2K3) or did your due diligence with the lockdown tool, you're perfectly safe.

how to parse and modify text files.

[twitter]

Ho would you push an update to a text file (code at that) through "Windoze Update", oh Master Developer Guru. Please enlighten us.

The same way Debian manages global some configuration files. If you chose, an auto configuration section will be marked by text in the file "#start auto configuration", "#end auto configuration" and managed. Customization of the file can still be done manually after the auto section.

If all that was required is a 5 line change to a global file, I'm sure that even M$ could manage it. Windoze updater can modify any file on your system can't it?

The problem is that it's not a simple five line change, it's a code rewrite and it does not really fix the problem.

Feeling enlightened yet?

Re:how to parse and modify text files.

[The Bungi]

The same way Debian manages global some configuration files.

Impressive.

M$ ... Windoze

They did.

The problem is that it's not a simple five line change

It is, unless you want to use the module above.

it does not really fix the problem.

It did. Why would you say it didn't? It fixes the problem. How would you now if it does or doesn't fix the problem? Because "I read it on Slashdot so it must be true"? You sure as heck don't seem to be much of a developer.

Feeling enlightened yet?

No, not really. Amused, I guess.

Re:how to parse and modify text files.

[twitter]

Impressive.

Yeah, so is your Cox home page.

Nice to know they fixed their little problem with a quarter meg download. Not quite a five line fix, now is it?

Why would you say it didn't? It fixes the problem. How would you now if it does or doesn't fix the problem?

Because they've had this kind of problem before and they will have it again.

Re:how to parse and modify text files.

[The Bungi]

Yeah, so is your Cox home page.

Well I suppose if you're mentioning my placeholder Cox homepage in the same breath as Debian I should be flattered. You really shouldn't have.

Nice to know they fixed their little problem with a quarter meg download.

Like I said, it's your choice. It's still five lines of code. If you want to push the fix across the enterprise to 1,000 servers I suppose an unattended MSI package install is a bit better. But wait, what am I saying!? Only "free software" is capable of these things!

On the other hand of course you think in terms of your two Celeron Leenucks "boxen" so in a way I understand your narrow view of both the problem and the solution.

Because they've had this kind of problem before and they will have it again.

Yep, and it will get fixed and it won't be quite so the end of the world as you and Slashdot would like to think it is. But I'm sure you'll still bitch cluelessly about it.

Re:how to parse and modify text files.

[twitter]

Like I said, it's your choice. It's still five lines of code. If you want to push the fix across the enterprise to 1,000 servers I suppose an unattended MSI package install is a bit better. But wait, what am I saying!? Only "free software" is capable of these things!

Having worked a BankOne "upgrade" I can say that it's true free software is much easier to push through a network than crap that requires M$ registry bullshit to work.

Yep [M$ will have the same problem again], and it will get fixed and it won't be quite so the end of the world as you and Slashdot would like to think it is. But I'm sure you'll still bitch cluelessly about it.

No, I'll just laugh thinking about how you will spend your weekend. Either way, code rewrite or patch push, it's loser. I've got better things to do with my time. How about you?

I suppose if you're mentioning my placeholder Cox homepage

Yep, one day you might have time to put something there or change your Slashdot homepage.

Re:how to parse and modify text files.

[The Bungi]

Oh. "M$" registry "bullshit", and at "BankOne" no less. Of course.

Once again I find myself outclassed.

Any site that requires tight security

[RodeoBoy]

doesn't or shouldn't use the url security. Every .net site I have worked on does explicit check on each page that needs to limit access. Also there is a fix for the problem, it is call windows 2003.

A possible root cause

[tomhudson]

roll-and-burn SUV, there's also the ongoing issue of rear gas tank ruptures in the Crown Vic, rear gas tank ruptures in the Mustang, and of course the... infamous Pinto.

Ahh - the "mother-in-law car".

As you pointed out, this seems to happen with every succeeding generation of Ford vehicles - like there's no "institutional memory" that remembers "We can't do it that way, 'cause here are the consequences".

And this is what it looks like happens at Microsoft - a lack of "institutional memory", as the same bugs are repeated in each new version of their products...