Urgent! Feb9th Update Killed My Site! Panicing!

[nx-2000]

Last night I dutifuly installed all the server 2000 updates that where
released and I finally get called a few hours ago by a client wondering
why our site was down. Then a steady flood of calls happened after
that.

I'm assuming that MS05-004 ASP.NET Path Validation Vulnerability has
somehow completely hosed my site and I can't for the life of me figure
out what the hell has happend or how to fix it but its critical I get
it up and running. Its been running fine for the last 2 years without
any interuption until last nights god damned update.

The main site is a customers site who has all these pages that are php
and so forth and it has two subfolders that are the application that we
wrote for them(one folder named gatherer, the other, tracker). Gatherer
is a web service that a local app on one of the customers computers
sends information up to the site, and the tracker page allows our
customers, customers, to view details on it.

Anything in the subfolders generate the error at the bottom of this
message("The resource cannot be found."), but if I move the files up
into the root of the website I can get them to work correctly. They've
just suddenly broken when running in subdirectories. I've rebooted,
chkdsk'd, created super-simple web.config files to test with, created
new test.aspx files with nothing more than "hello world" and I get this
freakin error on any aspx file in the subdirectories unless I turn off
the application settings for the folder and then none of my program
actually works.

Anyone know an answer on how I can fix this? Moving into the root path
is NOT a good answer as I'll have to recompile the client side apps and
get them out to a dozen or more people when it should be fine to begin
with.

Server Error in '/Gatherer' Application.
--------------------------------------------------------------------------------

The resource cannot be found.
Description: HTTP 404. The resource you are looking for (or one of its
dependencies) could have been removed, had its name changed, or is
temporarily unavailable. Please review the following URL and make sure
that it is spelled correctly.

Requested Url: /gatherer/gatherer.asmx

 

[google]

Welcome to the club. You'll want to monitor this previous thread as
well:

http://groups-beta.google.com/group...er=1&[email protected]#doc_53a030d752a82e49

I expect we'll know a lot more in 48 hrs.

James

 

[nx-2000]

I just finished figuring it out!

Under the root path in IIS configuration, check under "Home Directory"
under the field "local path". "c:\inetpub\mywebsite\" is not the same
as "c:\inetpub\mywebsite" apparently now. My site came back alive as
soon as I removed the trailing backslash so that the path now says
"c:\inetpub\mywebsite". Worked fine on my configuration.

 

[google]

Good find.

I've confirmed that this solution works on our systems as well.

Many thanks!

 

[Tim]

I just de-installed the .Net update and all is working ok now.
IMHO this is a drastic step, but this is also a dev box so not so drastic.
If this had been a production server I would have not been to happy to a)
find un tested updates installed and b) broken systems.

It will be re-installed when a clear cut work around or fix is documented.

- Tim

 

[arvee]

Thanks Folks! - I had the same problem and removing the trailing slash fix
it for me as well.

 

[Brian Hampson]

I just finished figuring it out!

Under the root path in IIS configuration, check under "Home Directory"
under the field "local path". "c:\inetpub\mywebsite\" is not the same
as "c:\inetpub\mywebsite" apparently now. My site came back alive as
soon as I removed the trailing backslash so that the path now says
"c:\inetpub\mywebsite". Worked fine on my configuration.

Thanks! Fixed it here too!