I see a question posted as a comment to his blog that looks like what you're asking - so you've probably already found that blog.
Note that multipart/form-data is used when your site accepts file uploads. So if you are accepting file uploads to your site, then we should assume that you have not disallowed that content type. Keep in mind though that if your site does not offer
file upload functionality, it does not mean that the content types noted above have actually been
disallowed. Disallowing those content types would need to be a specific action you would have taken when setting up the site and it appears that disallowing those content types is something that could be
done with your firewall.
The content type application/x-www-form-urlencoded is used when doing a standard POST. So is sometihng that i'd suspect all sites would support unless you've gone out of your way to limit your site to simple GET requests.
Ultimately, as soon as the Security update is released, I think you would want to look at getting it applied asap.
[edit]
this little exerp from the security advisory probably says it most succinctly:
How do I know if my service is vulnerable? Any version of ASP.NET is vulnerable if form submission is enabled using the HTTP POST method, which is the default configuration. Specially crafted HTTP GET requests do not cause the issue. .NET functionality other than ASP.NET, including client-side functionality,
is not affected.
None
0 Points
2 Posts
ASP.NET Denial of Service Vulnerability 2659883
Dec 29, 2011 10:46 AM|HelloThar|LINK
From the bulletin:
http://technet.microsoft.com/en-us/security/advisory/2659883
"Sites that disallow application/x-www-form-urlencoded or multipart/form-data HTTP content types are not vulnerable"
What does this mean, and how can I determine if my sites fall into this category?
All-Star
158169 Points
13158 Posts
ASPInsiders
Moderator
Re: ASP.NET Denial of Service Vulnerability 2659883
Dec 29, 2011 02:08 PM|mbanavige|LINK
A very good place to watch for news on this topic is Scott Gu's blog here:
http://weblogs.asp.net/scottgu/archive/2011/12/28/asp-net-security-update-shipping-thursday-dec-29th.aspx
I see a question posted as a comment to his blog that looks like what you're asking - so you've probably already found that blog.
Note that multipart/form-data is used when your site accepts file uploads. So if you are accepting file uploads to your site, then we should assume that you have not disallowed that content type. Keep in mind though that if your site does not offer file upload functionality, it does not mean that the content types noted above have actually been disallowed. Disallowing those content types would need to be a specific action you would have taken when setting up the site and it appears that disallowing those content types is something that could be done with your firewall.
None
0 Points
2 Posts
Re: ASP.NET Denial of Service Vulnerability 2659883
Dec 29, 2011 02:21 PM|HelloThar|LINK
Thanks for the insightful answer. Does application/x-www-form-urlencoded also apply to file uploads?
All-Star
158169 Points
13158 Posts
ASPInsiders
Moderator
Re: ASP.NET Denial of Service Vulnerability 2659883
Dec 29, 2011 02:29 PM|mbanavige|LINK
The content type application/x-www-form-urlencoded is used when doing a standard POST. So is sometihng that i'd suspect all sites would support unless you've gone out of your way to limit your site to simple GET requests.
Ultimately, as soon as the Security update is released, I think you would want to look at getting it applied asap.
[edit]
this little exerp from the security advisory probably says it most succinctly:
http://technet.microsoft.com/en-us/security/advisory/2659883
How do I know if my service is vulnerable?
Any version of ASP.NET is vulnerable if form submission is enabled using the HTTP POST method, which is the default configuration. Specially crafted HTTP GET requests do not cause the issue. .NET functionality other than ASP.NET, including client-side functionality, is not affected.
None
0 Points
2 Posts
Microsoft
Re: ASP.NET Denial of Service Vulnerability 2659883
Dec 30, 2011 01:05 PM|naziml|LINK
@HelloThar Not typically. That is usually for form POSTs.