????? ????? ??? ??????? ??????? ?? ASP.NET

???? ???????: 2425938 - ??? ???????? ???? ????? ????? ??? ???????.
????? ???????? ????? ????? ??????? ?????? ?????? ???????
????? ???? | ?? ????

??????

??????? ?????? ?????? ?? ???? ????? MS10-070 ?????? ??????? ??? ????? ??????? ?????????? ?? ASP.NET ?????? ?????? ?? ????? (?????) ???????? ??? ???????. ???? ??? ??????? ?????? ??????? ?????? ??? ?????? ?????? ??????? ?? ASP.NET.

?????? ??? ???? ?? ????????? ??? ??? ??????? ??????? ?? ?????? ???? ??? ??????:
http://www.microsoft.com/technet/security/bulletin/ms10-070.mspx
(http://www.microsoft.com/technet/security/bulletin/ms10-070.mspx)
???? ??? ?????? | ????? ???????

??????? ????

???? ASP.NET ?????????? ????? ??????? ?? ?????? ?? ??? ???????? ?? ???? ??????? ?? ?????? MachineKey. ????? ????? ?????? ???? ?? ??????? ????? MS10-070 ??????? ?????? ????????? ?? ??????? ?? ASP.NET ?????? ?????? ?? ????? ???????? ??? ????? ??? ?? ???? ??? ??????? ???.

??? ????? ??????? ?????? ?????? ?? ???? ?????? MS10-070? ??? ????? ???????? ??????? ????? ??? ????? ??????? ? ASP.NET:
  • ????? ????? ????????? ??? ????? ???????? ??????? ??? ????? HMAC ???? ????? ????.
  • ????? ?? ????? ????????? ??? ?????? ?? ??????? HMAC ??? ?? ??? ?? ????? ????????.
???????? ??????? ?? ASP.NET ????? ????????? (appSettings) ???? ???? ????? ???????? ??? ??? ??? ???????.
?? ??? ??????????? ??? ??????
?????????????? ????????????????? on.NET ????????
aspnet:UseLegacyEncryption???? ???????????Microsoft.NET Framework 2.0 Service Pack 1
Microsoft.NET Framework 2.0 Service Pack 2
Microsoft.NET Framework 3.5
Microsoft.NET Framework 3.5 Service Pack 1
???? ???.NET Microsoft 4.0
aspnet:UseLegacyMachineKeyEncryption???? ??????????????? ???.NET Microsoft 4.0
aspnet:ScriptResourceAllowNonJsFiles???? ???????????Microsoft.NET Framework 3.5 Service Pack 1
???? ???.NET Microsoft 4.0

??? appSetting aspnet:UseLegacyEncryption

???? ??? ??????? ????? ?? ??? ??? ??????? ???????? ??? ??? ????? ?????? ?? ????? ???????? ????? HMAC ??? ??? ?? ??? ????? ?????? ?????? ?? ????? ?? machineKey ?? ????? ASP.NET ?????? ?? ??? ??????? HMAC.
?? ??? ??????????? ??? ??????
aspnet:UseLegacyEncryption???
??? (???????)??? ??????? ?????? ASP.NET ?????? ?????? ?? ??? ??????? HMAC ???????? ??? ??? ????? ??? ????? ASP.NET ???????? ???????. ???? ??? ??? ??? ?? ??? ????? ?????? ?? ????? ?? machineKey ?????? ?????? ???????? ????? HMAC.
??????? ??????? ?????? ASP.NET ?? ?????? ?????? ?? ??? ??????? HMAC ????? ?? ?????? ???????? ??????? ? HMAC ??????? ?? ???? ?????? ?? ????? ?? machineKey.

????????? ???? ??? ??????? ???? ???? ??? ????? ?? ????? ?? ????? ???? ???????? ???????.

?????? ??? ???????? ?? ?????? ??????? ?????? ?? ??? web.config ????? ?? ????????? ?? ???????:
<configuration>
...
 <appSettings>
 ...
 <add key="aspnet:UseLegacyEncryption" value="false" />
 </appSettings>
</configuration>

??? appSetting aspnet:UseLegacyMachineKeyEncryption

???? ??? ??????? ?????? ?? ??? ??? ??????? ?? ????System.Web.Security.MachineKey???????? ??? ??? ????? ??? ?????? ?? ????? ???????? ????? HMAC ??? ??? ???????MachineKeyProtection?? ???? ????? ????? ?????? ?? ?????.
?? ??? ??????????? ??? ??????
aspnet:UseLegacyMachineKeyEncryption???
??? (???????)??? ??????? ?????? ASP.NET ?????? ?????? ?? ??? ??????? HMAC ??? ???????? ??? ???MachineKey??? ????? ??? ????? ASP.NET ???????? ???????. ???? ??? ??? ??? ???????MachineKeyProtection?? ???? ????? ????? ?????? ?? ?????.
??????? ??????? ?????? ASP.NET ?? ?????? ?????? ?? ??? ??????? HMAC ?? ????MachineKey??? ????? ?? ?????? ???????? ??????? ? HMAC ??????? ?? ???? ???????MachineKeyProtection?????.

????????? ???? ??? ??????? ???? ???? ??? ????? ?? ????? ?? ????? ???? ???????? ???????.

?????? ??? ???????? ?? ?????? ??????? ?????? ?? ??? web.config ????? ?? ????????? ?? ???????:
<configuration>
...
 <appSettings>
 ...
 <add key="aspnet:UseLegacyMachineKeyEncryption" value="false" />
 </appSettings>
</configuration>

??? appSetting aspnet:ScriptResourceAllowNonJsFiles

???? ??? ??????? ????? ?? ??? ??? ??????? ScriptResource.axd ?? ASP.NET ?????? ???? ????? JavaScript ??? (????.js). ScriptResource.axd ????? ????? ASP.NET ???? ???? ?????? ??????? ?????? JavaScript ??????? AJAX ?? ????? ??? ASP.NET.
?? ??? ??????????? ??? ??????
aspnet:ScriptResourceAllowNonJsFiles???
??? (???????)??? ??????? ?????? ASP.NET ????? ????? ??? ????.js (JavaScript) ?? ???? ??????? ScriptResource.axd ??????? ???.
???????? ??? ??????? ?????? ASP.NET ????? ?? ??? ???? ?? ??????? ASP.NET ???? ?? ?????? ??? ?? ???? ??????? ScriptResource.axd.

?????????? ??? ??????? ?? ??? ?? ????? ASP.NET ????? ?? ?? ??? ????? ?? ???? ???????. ??? ??? ?? ?? ??????? ??? ????? ??? ?????? ????? ?? ????? ?? ??? ??????? ???? ???????? ???? ???? ????????? ?????? ?????.

?????? ??? ???????? ?? ?????? ??????? ?????? ?? ??? web.config ????? ?? ????????? ?? ???????:
<configuration>
...
 <appSettings>
 ...
 <add key="aspnet:ScriptResourceAllowNonJsFiles" value="false" />
 </appSettings>
</configuration>
???? ??? ?????? | ????? ???????

?????

????? ?? ????????? ??? ???? MachineKey? ?? ?????? ???? ??? Microsoft ???????:
http://msdn.microsoft.com/en-us/library/w8h3skw9.aspx
(http://msdn.microsoft.com/en-us/library/w8h3skw9.aspx)
?????? ??? ???? ?? ????????? ???System.Web.Security.MachineKey?????? ?? ?????? ???? ??? Microsoft ???????:
http://msdn.microsoft.com/en-us/library/system.web.security.machinekey.aspx
(http://msdn.microsoft.com/en-us/library/system.web.security.machinekey.aspx)
?????? ??? ???? ?? ????????? ??? ????? ??????? ??????? ??????? (appSettings)? ???? ??? ????? ???????? ??????? ?????? ?? Microsoft Knowledge Base:
815786
(http://support.microsoft.com/kb/815786/ )
????? ????? ???????? ????????? ??????? ?? ??? ????? ????? ???????? Visual C#
313405
(http://support.microsoft.com/kb/313405 / )
????? ????? ???????? ????????? ??????? ?? ??? ????? ????? ???????? Visual Basic.NET ?? 2005 Visual Basic
?????? ??? ???? ?? ????????? ??? ????? ASP.Net? ???? ??? ??? ??????? ?????? ???? ??????? ?? ????? ????? Microsoft:
307626
(http://support.microsoft.com/kb/307626/ )
INFO: ???? ???? ??? ????? ASP.NET
???? ??? ?????? | ????? ???????

???????

???? ???????: 2425938 - ????? ??? ??????: 19/????/1431 - ??????: 0.1
????? ???
  • Microsoft .NET Framework 4.0
  • Microsoft .NET Framework 3.5 Service Pack 1
  • Microsoft .NET Framework 3.5
  • Microsoft .NET Framework 2.0 Service Pack 2
  • Microsoft .NET Framework 2.0 Service Pack 1 (x86)
????? ??????: 
kbexpertiseinter kbhowto kbsecurity kbsurveynew kbmt KB2425938 KbMtar
????? ????
???: ??? ????? ??? ?????? ???????? ?????? ????? ???? ????? ?????????? ????? ?? ????????? ?????? ????. ???? ???? ?????????? ???? ?? ???????? ???????? ?????? ????????? ????? ????????? ???????? ????? ???????? ?????? ?? ?????? ??? ?? ???????? ???????? ?? ????? ??????? ?????? ??? ??????? ?????? ??. ?????? ?? ???? ??? ??????? ???????? ????? ?? ???? ????? ?????? ??? ????? ??? ????? ??????? ?? ????? ?? ?????? ??? ??? ??????? ??????? ?? ????? ????? ????? ????? ?????. ?? ????? ???? ?????????? ??????? ??? ????? ?? ??????? ?? ????? ?????? ?? ??? ????? ?? ????? ??????? ?? ???????? ?? ??? ???????. ???? ???? ?????????? ???????? ??? ????? ?????? ??????? ??????
???? ??? ????? ??????? ?????? ??????????2425938
(http://support.microsoft.com/kb/2425938/en-us/ )
???? ??? ?????? | ????? ???????

????? ???????

 
???? ??? ?????????? ??? ??????