Looks like the consensus is that no version of IIS protects you from this vulnerability. If you have an ASP.NET application, and you rely on Url authorization ( sections), you need to fix your application ASAP.
The fix is very simple - it's a few lines of code that reject requests that have backslashes or are not in canonical form. Here is the knowledge base article that you should read that provides the fix.
Get to it, folks!
Posted
Oct 07 2004, 12:37 PM
by
keith-brown