• News
• Infocus
• Foundations
• Microsoft
• Unix
• IDS
• Incidents
• Virus
• Pen-Test
• Firewalls
• Columnists
• Mailing Lists
• Newsletters
• Bugtraq
• Focus on IDS
• Focus on Linux
• Focus on Microsoft
• Forensics
• Pen-test
• Security Basics
• Vuln Dev
• Vulnerabilities
• Jobs
• Job Opportunities
• Resumes
• Job Seekers
• Employers
• Tools
• RSS
• News
• Vulns
• Security Research

• info
• discussion
• exploit
• solution
• references

Microsoft ASP.NET URI Canonicalization Unauthorized Web Access Vulnerability

Solution:
Microsoft has released updates to address this vulnerability.

Microsoft has updated their original advisory to indicate that a revised fix is available for .NET Framework on Windows XP Tablet Edition and Media Center Edition. At the time of this writing, the fix was not available from the download link provided in the bulletin.


GOST 34.19-2001 Standard Implementation 1.0 SP3

• Microsoft ASP.NET Security Update for Microsoft .NET Framework 1.0 Service Pack 3
  This fix applies to .NET Framework 1.0 Service Pack 3 on the following platforms:Windows 2000 Service Pack 3 or Service Pack 4Windows XP Service Pack 1 or Windows XP Service Pack 2Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?familyid=4E6D56E5-3D8D -423B-99A1-41EDF23D65BC&displaylang=en


• Microsoft ASP.NET Security Update for Microsoft .NET Framework 1.0 Service Pack 3 on Tablet PC / Media Center
  This fix applies to .NET Framework 1.0 Service Pack 3 on the following platforms:Windows XP Tablet PC EditionWindows XP Media Center Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=EE611D27-52CF -43DB-BB97-21318C7FAA70&displaylang=en

GOST 34.19-2001 Standard Implementation 1.0 SP2

• Microsoft ASP.NET Security Update for Microsoft .NET Framework 1.0 Service Pack 2
  This fix applies to .NET Framework 1.0 Service Pack 2 on the following platforms:Windows 2000 Service Pack 3 or Service Pack 4Windows XP Service Pack 1 or Windows XP Service Pack 2Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?familyid=3271ACD5-EE3C -4BDF-AE28-56D2DF77151E&displaylang=en


• Microsoft ASP.NET Security Update for Microsoft .NET Framework 1.0 Service Pack 2 on Tablet PC / Media Center
  This fix applies to .NET Framework 1.0 Service Pack 2 on the following platforms:Windows XP Tablet PC EditionWindows XP Media Center Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=33D4D33E-473F -4842-A3A8-C8266AEE8FAB&displaylang=en

GOST 34.19-2001 Standard Implementation 1.1

• Microsoft ASP.NET Security Update for Microsoft .NET Framework 1.1
  This fix applies to .NET Framework 1.1 on the following platforms:Windows 2000 Service Pack 3 or Service Pack 4Windows XP Service Pack 1 or Windows XP Service Pack 2Windows XP Tablet PC EditionWindows XP Media Center Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=C5E19719-000F -456A-BEAB-5BD7949F8AA2&displaylang=en


• Microsoft ASP.NET Security Update for Microsoft .NET Framework 1.1 on Windows Server 2003
  This fix applies to .NET Framework 1.1 on the following platform:Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?familyid=E54BE8BE-22AF -4390-86E1-25D76794D5C7&displaylang=en

GOST 34.19-2001 Standard Implementation 1.1 SP1

• Microsoft ASP.NET Security Update for Microsoft .NET Framework 1.1 Service Pack 1
  This fix applies to .NET Framework 1.1 Service Pack 1 on the following platforms:Windows 2000 Service Pack 3 or Service Pack 4Windows XP Service Pack 1 or Windows XP Service Pack 2Windows XP Tablet PC EditionWindows XP Media Center Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=8EC6FB8A-29EB -49CF-9DBC-1A0DC2273FF9&displaylang=en


• Microsoft ASP.NET Security Update for Microsoft .NET Framework 1.1 Service Pack 1 on Windows Server 2003
  This fix applies to .NET Framework 1.1 Service Pack 1 on the following platform:Windows Server 2003
  http://www.microsoft.com/downloads/details.aspx?familyid=9BBD5617-49AE -40BF-B0FA-F9049349C6F5&displaylang=en