Solved

dot net frameword 1.1 removal from front end exchange.

Posted on 2010-08-20
4
569 Views
Last Modified: 2013-11-08
Hi,
I have my exchange front end running on windows 2003 enterprise with SP 2 as OS with 2003 exchange enterprise with SP2.
During last PCI scan an vulnerability "remote code execution in current dot net 1.1 version" comes on it. I have installed concerned patch but gap is still there.
Finally i plan to remove dot net version 1.1 from my server, please let me know how can i uninstall it and before uninstallation which version i should install which can replace it.
FYI :   IIS 6.0 is running on this server.
0
Comment
Question by:pdixit1977
  • 2
  • 2
4 Comments
 
LVL 24

Expert Comment

by:B H
ID: 33489563
1.1 is built into the server you can't make it go away

but, you can change your virtual sites to use dot net 2 or 3 or 4 depending on if your applications will support it.  

you would do that in iis, right-click the site, properties, IIS tab

make notes of what you change, so you can undo it if you need to.

for pci compliance, you might have to mitigate this another way - you can't secure yourself so much that you put yourself out of business - but you have to show that you did something for the pci compliance.  if you can use 2, 3, or 4, great.  if not, look into what your pci compliance authority would want you to do in order to keep 1.1 and still be "secure enough"

0
 

Author Comment

by:pdixit1977
ID: 33492035
PCI recommend me to install an particular patch to fix this gap, i did that but still it comes up. I asked them to consider this as "False Possitive" but they denied and asked me to fix it anyhow.
Thats why i was thinking to remove it and use other version....
0
 
LVL 24

Accepted Solution

by:
B H earned 250 total points
ID: 33492701
well try to switch to the other version in IIS as above... and then test your web applications and make sure they still work... if they do, great.  if not, you'll need to either find out what your pci compliance authority wants -after- patching like you did, or tell them it's a risk you'll have to take and provide the reasons why.   maybe you can compensate by turning up the logging level or something.

i mean, it's kind of like them asking you to use a certain type of combination lock to lock a door when all your employees are blind and you really need a key-lock or the whole door is pointless.
0
 

Author Closing Comment

by:pdixit1977
ID: 33494595
Good answer, thanks
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

MS Outlook is a world-class email client application that is mainly used for e-communication globally.  In this article, we will discuss the basic idea about MS Outlook, its advanced features, and types of MS Outlook File formats.
How to resolve IMCEAEX NDRs in Exchange or Exchange Online related to invalid X500 addresses.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question