Re: .exe uplpoads

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 05/20/04 

Date: Thu, 20 May 2004 01:42:09 -0700

You can use URLScan to disallow .EXE from being accepted by the server on
the URL (which disallows both requesting EXEs as well as uploading EXEs).
Otherwise, there is no generic feature for any web server to disallow the
upload of one file extension but not another. HTTP does not define an
"upload", and custom web server extension can implement "upload" in
arbitrary manners. 

-- 
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"anonymous" <anonymous@discussions.microsoft.com> wrote in message
news:f3e801c43db9$09a244d0$a301280a@phx.gbl...
Thanks in advance for any usefull replies.
Environment:
Win2k, 2000 FPSE, Intranet
Question:
Is it possible to disallow web editors from uploading .exe
files to the content directories, and still allow them to
go about daily content (.asp/.html) updating.
Editors use Frontpage 2000 or 2002.

Relevant Pages

  • Re: .exe uplpoads
    ... it is impossible for anything on the Web Server to determine ... whether it is an upload or not, thus it is not possible to stop web editors ... allowing upload of .EXE is no biggie. ... >You can use URLScan to disallow .EXE from being accepted ...
    (microsoft.public.inetserver.iis)
  • Re: Virus on Web Server
    ... Not unless something on your server renames it back to .exe and then ... > If I allow the user to upload a file of extension .gif to the web server ... will the user be able to upload a virus to the ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: File Upload - Security Issues
    ... You want to upload a file for what reason and ... these viruses have less chance of being able to execute (even if succeeded ... :> file and what pitfalls you see re: security might be helpful on this ... :>: files to an IIS server that doesn't have MS Office actually installed? ...
    (microsoft.public.scripting.vbscript)
  • Re: File Upload - Security Issues
    ... uploaded and the user could upload any or all of these in theory. ... There is no one product that can give you 100% security, ... > Code doesn't execute in local memory space unless remote user has rights ... > You don't have MS Office installed on the server. ...
    (microsoft.public.scripting.vbscript)
  • pure-ftp nologin
    ... I have a server running FreeBSD 6.3. ... # If you want to enable PAM authentication, ... AnonymousCanCreateDirs no ... # Disallow anonymous users to upload new files ...
    (comp.unix.bsd.freebsd.misc)