{"id":4711,"date":"2010-09-23T07:21:29","date_gmt":"2010-09-23T07:21:29","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/bharry\/2010\/09\/23\/security-vulnerability\/"},"modified":"2018-08-13T22:44:29","modified_gmt":"2018-08-13T22:44:29","slug":"security-vulnerability","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/bharry\/security-vulnerability\/","title":{"rendered":"Security Vulnerability"},"content":{"rendered":"<p>On Friday, a security researcher unveiled a new attack vector against ASP.NET applications.&nbsp; You can read more about it on<a href=\"http:\/\/weblogs.asp.net\/scottgu\/archive\/2010\/09\/18\/important-asp-net-security-vulnerability.aspx\"> Scott&#8217;s blog<\/a> or on the <a href=\"https:\/\/www.microsoft.com\/technet\/security\/advisory\/2416728.mspx\">Microsoft Security Advisory<\/a>.&nbsp; Because TFS is based on ASP.NET, it is affected by the vulnerability.&nbsp; The ASP.NET team is working hard on a fix and assures me a patch will be available soon.&nbsp; In the mean time, they have recommended a set of configuration\/application changes that can be made to eliminate the vulnerability.&nbsp; Unfortunately, the provided steps don&#8217;t work on all aspects of TFS (in part due to the level of ASP.NET behvior customization we have done).<\/p>\n<p>To provide you an avenue to protect your TFS server, we have put together a document on changes you can make to your various ASP.NET based TFS components.&nbsp; The changes are not complicated but they aren&#8217;t as simple as changing a configuration setting either.&nbsp; Further, some of the changes will make your TFS installation unserviceable (future patches from us won&#8217;t appliy properly) so you will need to undo these changes as soon as the &#8220;real&#8221; patch from the ASP.NET team has been applied.&nbsp; Given all of this, you will need to make your own assessment about the cost\/risk\/benefit equation of trying to take these steps.<\/p>\n<p>Numerous components of TFS and related services are affected by this vulnerability, including:<\/p>\n<ul>\n<li>TFS Web Services<\/li>\n<li>Team Web Access<\/li>\n<li>TFS Proxy<\/li>\n<li>Sharepoint<\/li>\n<li>Reporting Services<\/li>\n<\/ul>\n<p>The document I have attached to this post covers all of these cases except Reporting Services.&nbsp; The SQL team has not yet published a set of changes to work around the vulnerability in Reporting Services.&nbsp; The attached document includes the necessary changes for TFS 2010, TFS 2008 and TFS 2005.&nbsp; The link to the Sharepoint changes is only referenced in the TFS 2010 section but you should look at it no matter which version of TFS you are using.&nbsp; Also the TFS 2005 section does not include a section on the Proxy because it is the same as in the TFS 2008 section.<\/p>\n<p>We&#8217;re very sorry for the concern and difficulty this causes.&nbsp; As I mentioned above, the ASP.NET team will be producing a more seamless fix very soon.<\/p>\n<p>Brian<\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/MSDNBlogsFS\/prod.evol.blogs.msdn.com\/CommunityServer.Components.PostAttachments\/00\/10\/06\/67\/40\/TFS%20Mitigation%20of%20Advisory%202416728.docx\">TFS Mitigation of Advisory 2416728.docx<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>On Friday, a security researcher unveiled a new attack vector against ASP.NET applications.&nbsp; You can read more about it on Scott&#8217;s blog or on the Microsoft Security Advisory.&nbsp; Because TFS is based on ASP.NET, it is affected by the vulnerability.&nbsp; The ASP.NET team is working hard on a fix and assures me a patch will [&hellip;]<\/p>\n","protected":false},"author":244,"featured_media":14617,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[5],"class_list":["post-4711","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-tfs"],"acf":[],"blog_post_summary":"<p>On Friday, a security researcher unveiled a new attack vector against ASP.NET applications.&nbsp; You can read more about it on Scott&#8217;s blog or on the Microsoft Security Advisory.&nbsp; Because TFS is based on ASP.NET, it is affected by the vulnerability.&nbsp; The ASP.NET team is working hard on a fix and assures me a patch will [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/posts\/4711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/users\/244"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/comments?post=4711"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/posts\/4711\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/media\/14617"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/media?parent=4711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/categories?post=4711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/bharry\/wp-json\/wp\/v2\/tags?post=4711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}