| |
Retina vs. IIS4, Round 2 - The Ogle
This is a quick fix to allow .htr files therefore not breaking functionality such as /iisadmpwd/. Some companies were asking if there was a possible way to fix the .htr hole without removing the .htr ISAPI filter. Here is the fix to do so.
The filter patch we created will limit all .htr requests to 255 characters, therefore if someone tries the overflow it will get cut off and will never happen. Also, the IP address of the person trying the overflow is logged in the application log file along with the actual query.
Credits:
This is a modification of ASPBUGFILTER by Christoph Wille Christoph.Wille@softwing.com, AUSTRIA.
The fix was inspired by,
Brett Glass
http://www.brettglass.com/mailbrett.html
Niall McKay
P.S.
This is not a perfect patch as there are more overflows in ism.dll than just .htr extensions... but this patch is a lot better than current recomendations and it is open source so you can hack it up to do whatever you like... maybe redirect people to a page telling them they have been logged or some "scary" thing.
Instructions
------------
Unzip the contents of this zip file to something like c:\ogle\
Then double click the .reg file to register the patch filter with the event viewer.
Next, go to ISM and view the properties of the site you want to protect
Click the ISAPI filter tab.
Click Add, enter OGLE as the name and browse for the ogle.dll file.
Click OK to add.
Click the apply button.
Enjoy...
|