Solved

dot net frameword 1.1 removal from front end exchange.

Posted on 2010-08-20
4
571 Views
Last Modified: 2013-11-08
Hi,
I have my exchange front end running on windows 2003 enterprise with SP 2 as OS with 2003 exchange enterprise with SP2.
During last PCI scan an vulnerability "remote code execution in current dot net 1.1 version" comes on it. I have installed concerned patch but gap is still there.
Finally i plan to remove dot net version 1.1 from my server, please let me know how can i uninstall it and before uninstallation which version i should install which can replace it.
FYI :   IIS 6.0 is running on this server.
0
Comment
Question by:pdixit1977
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 24

Expert Comment

by:B H
ID: 33489563
1.1 is built into the server you can't make it go away

but, you can change your virtual sites to use dot net 2 or 3 or 4 depending on if your applications will support it.  

you would do that in iis, right-click the site, properties, IIS tab

make notes of what you change, so you can undo it if you need to.

for pci compliance, you might have to mitigate this another way - you can't secure yourself so much that you put yourself out of business - but you have to show that you did something for the pci compliance.  if you can use 2, 3, or 4, great.  if not, look into what your pci compliance authority would want you to do in order to keep 1.1 and still be "secure enough"

0
 

Author Comment

by:pdixit1977
ID: 33492035
PCI recommend me to install an particular patch to fix this gap, i did that but still it comes up. I asked them to consider this as "False Possitive" but they denied and asked me to fix it anyhow.
Thats why i was thinking to remove it and use other version....
0
 
LVL 24

Accepted Solution

by:
B H earned 250 total points
ID: 33492701
well try to switch to the other version in IIS as above... and then test your web applications and make sure they still work... if they do, great.  if not, you'll need to either find out what your pci compliance authority wants -after- patching like you did, or tell them it's a risk you'll have to take and provide the reasons why.   maybe you can compensate by turning up the logging level or something.

i mean, it's kind of like them asking you to use a certain type of combination lock to lock a door when all your employees are blind and you really need a key-lock or the whole door is pointless.
0
 

Author Closing Comment

by:pdixit1977
ID: 33494595
Good answer, thanks
0

Featured Post

DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Unified and professional email signatures help maintain a consistent company brand image to the outside world. This article shows how to create an email signature in Exchange Server 2010 using a transport rule and how to overcome native limitations …
In this video we show how to create a Resource Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: Navigate to the Recipients >> Resources tab.: "Recipients" is our default selection …
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

729 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question