Re: HOW TO Restrict FileSystemObject (fso) to ASP context
From: Ken Schaefer (kenREMOVE_at_THISadOpenStatic.com)
Date: 09/03/04
- Next message: Markus: "RE: Installing IIS on XP Professional"
- Previous message: NO SPAM: "IIS ASP Issue, also SUS"
- In reply to: Renaud COLAS: "HOW TO Restrict FileSystemObject (fso) to ASP context"
- Next in thread: David Boyer: "Re: HOW TO Restrict FileSystemObject (fso) to ASP context"
- Messages sorted by: [ date ] [ thread ]
Date: Fri, 3 Sep 2004 12:05:53 +1000
Of course you should be using NTFS permissions to restrict an object that
manipulates the file system, what else do you think NTFS (NT *File*
*System*) permissions are for?!?
The File System Object doesn't know anything about whether a file is
"inside" a website or not - it just sees the physical disk. You can either
set NTFS permissions on the .dll that houses the FSO, or on the registry, or
on the files you don't want to be manipulated.
Cheers
Ken
"Renaud COLAS" <NO_SPAM_BUDcolas.r@free.fr> wrote in message
news:ch87dk$c5l$1@news-reader5.wanadoo.fr...
> Hi all,
>
> Facing some hack activities from ZEHIR, I need to make sure that
> FileSystemObject is not being used out of the ASP context.
> That means I do not want a path to be out of the current site (basically,
> no
> way to acces hard disk root folders like "c:\", "d:\" and so on, hence no
> way to go down to the "\windows" folder.
>
> I can not use the credentials (over 4000 web site to handle), therefore I
> searching for a way (by registry for instance) to get this restriction on.
>
> Since Microsoft stands keeps on offering this great tool for years now,
> I'd
> hope they'd put out a way to guarantee a safe usage, but I'm
> disappointed...
> I'd consider this as a major security hole, major because of the time it's
> being offered without other best pratice than dealing with user rights (on
> IUSR per site).
>
> If anybody had a solution, I'd be very thankfull to read it ! ;-)
>
> Best regards,
>
> Renaud
>
>
- Next message: Markus: "RE: Installing IIS on XP Professional"
- Previous message: NO SPAM: "IIS ASP Issue, also SUS"
- In reply to: Renaud COLAS: "HOW TO Restrict FileSystemObject (fso) to ASP context"
- Next in thread: David Boyer: "Re: HOW TO Restrict FileSystemObject (fso) to ASP context"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
