|
1
1
|
Is there an official workaround from Fogcreek to apply to our FogBugz installation that addresses the ASP.NET security vulnerability identified recently? http://www.microsoft.com/technet/security/advisory/2416728.mspx http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx |
||
|
|
|
2
|
I don't think FogBugz is even vulnerable to this exploit. While it's hosted in ASP.NET, FogBugz is not itself a normal ASP.NET application. It doesn't use any ASP.NET controls and doesn't use the ViewState at all (I checked both the generated HTML for some pages and searched the source code). As for accessing Web.config, there's nothing sensitive in there. Besides that, the workaround mentioned in that blog post is pretty standard practice for ASP.NET developers. |
||
|
|
|
2
|
FogBugz redirects all errors to a single error handler ("internalError.asp"), which should prevent attackers from exploiting this vulnerability. |
||
|
|
