News for hackers. Stuff that matters.

A comment on New ASP.NET Security Vulnerability could allow access to web.config. Parent comment

Re:New ASP.NET Security Vulnerability could allow access to ... by jasonkester on Sunday September 19, 2010 @03:40AM (#1705797)
The article is a bit vague there, bit I didn't read it to mean you couldn't distinguish 404s from 500s.

It seems to say that you shouldn't tell people which flavor of 5xx he got, since that's useful info to an attacker.

As I mentioned in another thread, this doesn't seem like it would affect any real sites, so it's not a case of waiting for (gasp) months for a patch while your server is in real jeopardy.

Security warnings like this come through for ASP.NET a couple times a year, but nearly all of them are of the "don't do the stuff you already shouldn't be doing, or bad things might happen" variety.

[ Parent | on HN ]
Re:New ASP.NET Security Vulnerability could allow access to ... by MichaelApproved on Sunday September 19, 2010 @02:20PM (#1706614)
The 404 restriction is driven home in the comments. Many users ask and its repeated several times that all errors should be 500, even 404.
[ Parent | on HN ]