seems strange the this site doesn't have the valnerability listed on the news or support pages.  Nor can I find any helpful information in the forum yet. 

I appreciate this valnerability has little to do with the DNN framework and is actually a .NET issue, but it obviously affects every DNN site and I would think there should be a lot of chatter about it by now?  Especially as there is a YouTube video explaining how to hack a DNN site and get host account details...

Anyway, I've received the DNN newsletter, which details the issue a little and provides links to a short term step by step fix pdf, however the link in the newsletter does not work for me. Does anyone know the correct link to the file:

DotNetNuke_Security_Update_Regarding_ASPNET_Vulnerability_091810.pdf

hosted somewhere on this server.  If you do, can you please post the link here so we can all begin applying the necessary patches.

Thanks,

Reuben.

---

for info on our website DNN skinning, feel free to check out our website at: www.spwd.co.nz

besides there have been published a couple of valuable posts in the blogs and forums.

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN

FYI: a MVP collegue from Czech created a HTTP module to apply the patch to a whole server on IIS 7 and above, see http://oraclebugfix.codeplex.com/ 
I haven't checked it out myself, but you might want to give it a try.

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN