Reported Vulnerability in Microsoft ASP.NET

Follow-Up: The ASP.NET Team has confirmed that all versions of ASP.NET on all operating systems may be susceptible to this potential exploit. They strongly recommend you apply the following code to the Global.asax for each of your applications.

Global.asax code sample (Visual Basic .NET)

Sub Application_BeginRequest(Sender as Object, E as EventArgs)
  If (Request.Path.IndexOf(chr(92)) >= 0 OR _
    System.IO.Path.GetFullPath(Request.PhysicalPath) <> Request.PhysicalPath) Then
    Throw New HttpException(404, “Not Found”)
  End If
End Sub

Global.asax code sample (C#)

void Application_BeginRequest(object source, EventArgs e) {
  if (Request.Path.IndexOf(”) >= 0 ||
    System.IO.Path.GetFullPath(Request.PhysicalPath) != Request.PhysicalPath) {
    throw new HttpException(404, “not found”);
  }
}