-1

below Findings from Vulnerability Assessment & Penetration Testing,

kindly help me anyone done this in SharePoint 2013

1- Cryptographic Padding Oracle This website is vulnerable to Oracle Cryptographic Padding vulnerability. This vulnerability in ASP.NET could allow information disclosure.

2- Allowed to browse root's home directory How to Disable/restrict the USerDir module for the web server.

3- DOS Attack Possible on Website by shtml.exe

4.Microsoft Site Server GroupManager.asp Arbitrary LDAP Modification This website is vulnerable to Oracle Cryptographic Padding vulnerability. This vulnerability in ASP.NET could allow information disclosure.

0
  1. If you keep your Servers current with MS Updates you should be patched for the Oracle Cryptographic Padding vulnerability. I advise you to run your Windows updates on all servers ASAP. See this link
  2. You can turn off directory browsing in IIS. See this link
  3. This is related to an old FrontPage extensions bug. How old are you servers? This should also be patched by Windows updates!
  4. Will be addressed at the same time as 1.
  5. I know you don't have a 5 but it is very important. You need to establish a patching and security policy. If you don't know how to do this get a consultant to do this for you. It will cost you less in the long run.
  • Thank you very much for your reply , This is related to an old FrontPage extensions bug. How old are your servers? This should also be patched by Windows updates! Windows server 2012 R2 standard We installed recently But there is no update for windows 2012 R2 – Anand Feb 26 '17 at 12:28
  • Windows 2012 R2 has a ton of updates. You should be using Windows update regularly. For production environment you may wish to pick and choose what those updates are or at the very least have a staging environment to verify the updates beforehand. – Bunzab Feb 26 '17 at 13:35
  • I'm also surprised that you are seeing these issues in Windows 2012 environment. I would have expected them to be addresses some time ago. It could be down to the versions of .net you are using. Check they are up to date. Turn off the server side includes feature (allows shtml) if you are not using it. If you are using it check the IIS handler mappings you have and remove it from there (although I'm pretty certain it has to be manually created in the first place). – Bunzab Feb 26 '17 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.