Does anyone know anything about this?  I got an email from them at 2:45am this morning announcing that they had discovered a security flaw in DNN, and had applied a patch to all of their existing customers.  ...I have 3 sites with them, so I was pretty happy.  But I also have 1 DNN site not on their servers (not by my choice).  I ran their DotNetNuke Security scanner against it, and it showed that the other site did have the security flaw.

Here's the Security Scanner they have to look at any DNN site you have.
http://www.powerdnn.com/Security/tabid/287/Default.aspx
If you host with them, they've already fixed your site.  If you don't, and the scanner find the vulnerability, they will help you fix it for a modest $20 fee.

Does anyone know anything about this security hole?  Is there a general DNN patch for it yet? 

Below are the results of the PowerDNN Security Scan when run against my non PowerDNN site.

  When is a patch going to be available for this security hole?  I installed this site less than a month ago, with the latest binaries. 

GMartin:

What version of DNN are you running?

Have you reported this to security@dotnetnuke.com?

Also, take the warnings with a grain of salt, modifying the web.config and running any SQL Script is not that easy if the server is setup properly and the admin/host accounts are not compromised.  I don't think there are any widespread security holes in DNN but you have to be careful with a misconfigured server, which they should be helping you with.

Carlos

I contacted PowerDNN for help with this issue ( I have sites hosted with them but I manage other sites that are hosted by us). I just got off the phone with a technician and via LiveMeeting we were able to patch our sites quickly and easily. It was painless and yes it cost a bit but I will sleep well tonight knowing that I won't wake up to a hell job tomorrow!

PowerDNN is the best DNN host going!

I cannot say enough good things about them. They KNOW DNN and they love it. The only reason they would not publish this fix is that doing so would put at risk thousands of DNN sites. It's up to the core team to quickly come up with a fix and release a new version. If you are not running the most recent version you are AT RISK!