這個月由於要忙於系統上線的關係~
所以程式要進機房~當然基於開放的前提下要做資安掃描
結果就發生了 .NET Framework ASP.NET Padding Oracle 重大缺失
要解決這個重大缺失的方法可以參考
http://cert.shnet.edu.cn/anquangonggao/.net-framework-asp.net-padding
算是比較完整的當然對方應該也會給你一個錯誤報告上方應該也會有寫
主要也就是
.NET Framework 3.5 Service Pack 1之後版本
Web.config下
<customErrors mode="On" redirectMode="ResponseRewrite"
defaultRedirect="~/ErrorPage.aspx" />
然後新增一個一個存ASPX的網頁取名ErrorPage.aspx(名字自己訂就好跟上方呼應即可)
然後網頁內容
C#
<%@ Page Language="C#" AutoEventWireup="true" %>
<%@ Import
Namespace="System.Security.Cryptography" %>
<%@ Import
Namespace="System.Threading" %>
<script
runat="server">
void Page_Load() {
byte[] delay = new
byte[1];
RandomNumberGenerator prng = new
RNGCryptoServiceProvider();
prng.GetBytes(delay);
Thread.Sleep((int)delay[0]);
IDisposable
disposable = prng as IDisposable;
if (disposable != null) {
disposable.Dispose(); }
}
</script>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html
xmlns="
http://www.w3.org/1999/xhtml">
<head
runat="server">
<title></title>
</head>
<body>
<div>
An
error occurred while processing your
request.
</div>
</body>
</html>
VB
<%@ Page Language="VB" AutoEventWireup="true" %>
<%@ Import
Namespace="System.Security.Cryptography" %>
<%@ Import
Namespace="System.Threading" %>
<script
runat="server">
Sub Page_Load()
Dim delay As Byte() = New
Byte(0) {}
Dim prng As RandomNumberGenerator = New
RNGCryptoServiceProvider()
prng.GetBytes(delay)
Thread.Sleep(CType(delay(0),
Integer))
Dim disposable As IDisposable = TryCast(prng,
IDisposable)
If Not disposable Is Nothing
Then
disposable.Dispose()
End If
End
Sub
</script>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0
Transitional//EN" "
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html
xmlns="
http://www.w3.org/1999/xhtml">
<head
runat="server">
<title></title>
</head>
<body>
<div>
An
error occurred while processing your
request.
</div>
</body>
</html>
iis重啟
當然假如你以上都做完還是沒過的話
那就是window update的問題了
基本上我會建議先做完window update
會比較沒問題以上是我的慘痛經驗
