Site security wont pass.

I have a site running windows 2003 server, to which port 80 is open. I'm getting this failing rating from security compliance. the following is the patches they want. I installed them and still get non compliance.

Description: vulnerable Microsoft.NET Framework version: 1.1.4322 site &ipaddress Windows Server 2003Feb 10 16:28:55 2011newSeverity: Area of Concern CVE: CVE-2007-0041 CVE-2007-0042 CVE-2007-0043 9.32352new11Impact: On a workstation, a remote attacker could execute arbitrary commands when a user opens a specially crafted web page. On a server, a remote attacker could gain unauthorized access to configuration files. Background: The .NET Framework is a programming model for building Windows applications. Resolution Install the patch referenced in Microsoft Security Bulletins [http://www.microsoft.com/technet/securi      ty/bulletin/ms10-041.mspx] 10-041 and [http://www.microsoft.com/technet/securi      ty/bulletin/ms10-060.mspx] 10-060. Vulnerability Details: Service: http Received: X-AspNet-Version: 1.1.4322  
JoeyTheGreatAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

cdsathyaCommented:
Try to connect widows update services, and install all patches givn by Microsoft
0
rajkumartechCommented:
Try restarting Application pool on your IIS.
0
dave4dlCommented:
I think you have to restart the whole computer after this update.
0
SD-WAN: Making It Work for You

As bandwidth requirements and Internet costs grow, businesses naturally want to manage budgets by reducing reliance on their most expensive connection types. Learn more about how to make SD-WAN work for your business in our upcoming webinar!

JoeyTheGreatAuthor Commented:
I did restart after installing the updates.
0
l8rgdkdCommented:
I have the same problem... I have installed all windows updates and I can not get this message to go away in my security scans.
0
JoeyTheGreatAuthor Commented:
I ended up contacting the certification company, they wanted a screenshot of the required update installed "update installed successful dialogue" and they'll override it as a false positive.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
l8rgdkdCommented:
good advice, ill give it a try
0
JoeyTheGreatAuthor Commented:
everydody had good ideas but none did anything to pass the failed state.
0
PBOICommented:
I was having this exact same issue, and I wanted to share some information that I found.  To get past the compliance issue for me, the resolution was tied to IIS.  In IIS, go to your default website, and likely any other websites you have listed, and change .NET being used from 1.1.4322 to 2.0.50727.

On my Citrix server, this was easy.  There was a ASP .NET tab on the website with a convenient dropdown for the version of .NET to implement.

On my OWA server, this was much more painful.  The tab was not there.  Instead you go to Home Directory (tab), Configuration (of the App Pool) and edit each .net aspnet_isapi.dll to point to your new framework path.  Example new path: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll

However, the nightmare is just beginning.  As soon as you do this, owa is shot, and all of your phone email apps are going to bug out.  The solution:  http://www.msexchange.org/tutorials/Fixing-Damaged-Incorrectly-Configured-OWA-2003-Installation.html

Get Metabase Explorer from IIS 6.0 Resource Kit http://www.microsoft.com/downloads/en/details.aspx?FamilyID=56fc92ee-a71a-4c73-b628-ade629c89499&DisplayLang=en

Backup the IIS Metabase by opening IIS Manager, right-click default website (and any others you have), select "save configuration to a file," and save.  Then delete the OWA Virtual Directories in your default web site: Exadmin, Exchange, Exchweb, Microsoft-server-activesync, oma, public.  Close IIS

Open Start, Programs, IIS Resources, Metabase Explorer, Metabase Explorer.
Expand Server (local)>LM
Right-click DS2MB key and delete

Open services.msc and restart Microsoft Exchange System Attendant Service.  This will recreate your deleted virtual directories.

"Almost that is, as there’s one more little thing to do. We need to reset the access permissions to Anonymous on the ExchWeb virtual directory. In order to do so start the IIS Manager then right-click the ExchWeb virtual directory and select Properties. Now select the Directory Security tab and click Edit under Authentication and access control. Make sure the Anonymous access and Integrated Windows Authentication check boxes are enabled then click OK and Apply. If an Inheritance Overrides dialog box pops up make sure you click Select All then OK. Under Authentication and access control, click Edit then clear the Integrated Windows authentication check box again. Click OK twice and you’re done."


0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft IIS Web Server

From novice to tech pro — start learning today.