At 11:47 03-04-00 , Peter Benoit wrote:
>On most sites that use Microsoft's ASP technology, 
>you can view the source of any of the .asp files. 

Does anybody really think that the patch will change things? Will fix the
problem, not just one more reincarnation of the symptom?

Frankly, I've lost track of how many back doors Microsoft has put in that
allow the ASP source to be viewed. First it was putting a period at the end
of the file name. Then it was ::$DATA (or something like that). Now it is
something else.

No doubt conspiracy theorists find this one easy to explain... and perhaps
fear that Microsoft's subcontractors have gone on to bigger and better
things, such as making commercial use of what back doors they've learned
(or perhaps planted). Or that the NSA-Microsoft tie-in (explaining one of
the revealed symbols recently) is broader than what was originally
suspected (and denied by Microsoft). ... ... ... and the list goes on.

Personally, I think it demonstrates one of the principles of security, that
security of a secret-source software product is at best tenuous and evasive.

>Bascially, any IIS server that can find null.htw
>will allow you to view the source. A patch <
>http://www.microsoft.com/technet/security/bulletin/ms00-006.asp> 
>was released on friday. But from what I've seen, 
>it hasn't been widely used yet.

The devil know can be comforting, compared with the devil unknown. Given
Microsoft's history of regression problems (reintroducing previously-fixed
bugs) in hotfixes, many are likely watching NTbugTraq and similar lists for
others' experiences before taking the plunge themselves.

Safe computing,  /Harold
 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Harold A. Driscoll                 mailto:Harold(at)Driscoll.Chi.IL.US
#include <std/disclaimer>                 http://Driscoll.Chi.IL.US

• Web Designer Courses
• Off the Shelf Training Courses

HWG hwg-techniques mailing list archives, maintained by Webmasters @ IWA