Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Site security wont pass.

Posted on 2011-02-10
9
Medium Priority
?
573 Views
Last Modified: 2012-05-11
I have a site running windows 2003 server, to which port 80 is open. I'm getting this failing rating from security compliance. the following is the patches they want. I installed them and still get non compliance.

Description: vulnerable Microsoft.NET Framework version: 1.1.4322 site &ipaddress Windows Server 2003Feb 10 16:28:55 2011newSeverity: Area of Concern CVE: CVE-2007-0041 CVE-2007-0042 CVE-2007-0043 9.32352new11Impact: On a workstation, a remote attacker could execute arbitrary commands when a user opens a specially crafted web page. On a server, a remote attacker could gain unauthorized access to configuration files. Background: The .NET Framework is a programming model for building Windows applications. Resolution Install the patch referenced in Microsoft Security Bulletins [http://www.microsoft.com/technet/securi      ty/bulletin/ms10-041.mspx] 10-041 and [http://www.microsoft.com/technet/securi      ty/bulletin/ms10-060.mspx] 10-060. Vulnerability Details: Service: http Received: X-AspNet-Version: 1.1.4322  
0
Comment
Question by:JoeyTheGreat
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
9 Comments
 
LVL 2

Expert Comment

by:cdsathya
ID: 34869065
Try to connect widows update services, and install all patches givn by Microsoft
0
 
LVL 3

Expert Comment

by:rajkumartech
ID: 34869696
Try restarting Application pool on your IIS.
0
 
LVL 15

Expert Comment

by:dave4dl
ID: 34875621
I think you have to restart the whole computer after this update.
0
Moving data to the cloud? Find out if you’re ready

Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.

 

Author Comment

by:JoeyTheGreat
ID: 34880842
I did restart after installing the updates.
0
 

Expert Comment

by:l8rgdkd
ID: 35082020
I have the same problem... I have installed all windows updates and I can not get this message to go away in my security scans.
0
 

Accepted Solution

by:
JoeyTheGreat earned 0 total points
ID: 35082726
I ended up contacting the certification company, they wanted a screenshot of the required update installed "update installed successful dialogue" and they'll override it as a false positive.
0
 

Expert Comment

by:l8rgdkd
ID: 35082771
good advice, ill give it a try
0
 

Author Closing Comment

by:JoeyTheGreat
ID: 35126247
everydody had good ideas but none did anything to pass the failed state.
0
 
LVL 4

Expert Comment

by:PBOI
ID: 35158274
I was having this exact same issue, and I wanted to share some information that I found.  To get past the compliance issue for me, the resolution was tied to IIS.  In IIS, go to your default website, and likely any other websites you have listed, and change .NET being used from 1.1.4322 to 2.0.50727.

On my Citrix server, this was easy.  There was a ASP .NET tab on the website with a convenient dropdown for the version of .NET to implement.

On my OWA server, this was much more painful.  The tab was not there.  Instead you go to Home Directory (tab), Configuration (of the App Pool) and edit each .net aspnet_isapi.dll to point to your new framework path.  Example new path: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll

However, the nightmare is just beginning.  As soon as you do this, owa is shot, and all of your phone email apps are going to bug out.  The solution:  http://www.msexchange.org/tutorials/Fixing-Damaged-Incorrectly-Configured-OWA-2003-Installation.html

Get Metabase Explorer from IIS 6.0 Resource Kit http://www.microsoft.com/downloads/en/details.aspx?FamilyID=56fc92ee-a71a-4c73-b628-ade629c89499&DisplayLang=en

Backup the IIS Metabase by opening IIS Manager, right-click default website (and any others you have), select "save configuration to a file," and save.  Then delete the OWA Virtual Directories in your default web site: Exadmin, Exchange, Exchweb, Microsoft-server-activesync, oma, public.  Close IIS

Open Start, Programs, IIS Resources, Metabase Explorer, Metabase Explorer.
Expand Server (local)>LM
Right-click DS2MB key and delete

Open services.msc and restart Microsoft Exchange System Attendant Service.  This will recreate your deleted virtual directories.

"Almost that is, as there’s one more little thing to do. We need to reset the access permissions to Anonymous on the ExchWeb virtual directory. In order to do so start the IIS Manager then right-click the ExchWeb virtual directory and select Properties. Now select the Directory Security tab and click Edit under Authentication and access control. Make sure the Anonymous access and Integrated Windows Authentication check boxes are enabled then click OK and Apply. If an Inheritance Overrides dialog box pops up make sure you click Select All then OK. Under Authentication and access control, click Edit then clear the Integrated Windows authentication check box again. Click OK twice and you’re done."


0

Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as high-speed processing of the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…
Want to learn how to record your desktop screen without having to use an outside camera. Click on this video and learn how to use the cool google extension called "Screencastify"! Step 1: Open a new google tab Step 2: Go to the left hand upper corn…

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question