Solved

dot net frameword 1.1 removal from front end exchange.

Posted on 2010-08-20
4
567 Views
Last Modified: 2013-11-08
Hi,
I have my exchange front end running on windows 2003 enterprise with SP 2 as OS with 2003 exchange enterprise with SP2.
During last PCI scan an vulnerability "remote code execution in current dot net 1.1 version" comes on it. I have installed concerned patch but gap is still there.
Finally i plan to remove dot net version 1.1 from my server, please let me know how can i uninstall it and before uninstallation which version i should install which can replace it.
FYI :   IIS 6.0 is running on this server.
0
Comment
Question by:pdixit1977
  • 2
  • 2
4 Comments
 
LVL 24

Expert Comment

by:B H
ID: 33489563
1.1 is built into the server you can't make it go away

but, you can change your virtual sites to use dot net 2 or 3 or 4 depending on if your applications will support it.  

you would do that in iis, right-click the site, properties, IIS tab

make notes of what you change, so you can undo it if you need to.

for pci compliance, you might have to mitigate this another way - you can't secure yourself so much that you put yourself out of business - but you have to show that you did something for the pci compliance.  if you can use 2, 3, or 4, great.  if not, look into what your pci compliance authority would want you to do in order to keep 1.1 and still be "secure enough"

0
 

Author Comment

by:pdixit1977
ID: 33492035
PCI recommend me to install an particular patch to fix this gap, i did that but still it comes up. I asked them to consider this as "False Possitive" but they denied and asked me to fix it anyhow.
Thats why i was thinking to remove it and use other version....
0
 
LVL 24

Accepted Solution

by:
B H earned 250 total points
ID: 33492701
well try to switch to the other version in IIS as above... and then test your web applications and make sure they still work... if they do, great.  if not, you'll need to either find out what your pci compliance authority wants -after- patching like you did, or tell them it's a risk you'll have to take and provide the reasons why.   maybe you can compensate by turning up the logging level or something.

i mean, it's kind of like them asking you to use a certain type of combination lock to lock a door when all your employees are blind and you really need a key-lock or the whole door is pointless.
0
 

Author Closing Comment

by:pdixit1977
ID: 33494595
Good answer, thanks
0

Featured Post

Will my email signature work in Office 365?

You've built an email signature using raw HTML code in Office 365, but you can't review how it looks with Transport Rules. So you have to test it over and over again before it can be used. Isn't this a bit of a waste of your time? Wouldn't a WYSIWYG editor make it a lot easier?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Find out what you should include to make the best professional email signature for your organization.
Read this checklist to learn more about the 15 things you should never include in an email signature.
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now