Tuesday, 21 October 2014

Another obscure Trustwave PCI scan fail - SBS 2011 fails CVE-2010-3332 / MS10-070, vulnerability in ASP.NET Could Allow Information Disclosure

After clearing up the SharePoint issues, there was just one remaining failure issue in the Trustwave PCI scan of an SBS 2011 server.

The fix turned out to be running the .NET Framework Cleanup Tool from Aaron Stebner at Microsoft, and removing .NET 1.0 and 1.1.

There's some more detailed discussion over at Technet

at

3 comments:

  1. Jere28 October 2014 at 16:13

    I'm failing the same Trustwave test, also on SBS 2011 - removed .NET 1.0 and 1.1 - but still failing after reboot.

    Any ideas?

    ReplyDelete
  2. Jere28 October 2014 at 16:40

    Are you running .NET 4.5 or just 4.0?

    ReplyDelete
  3. redleg29 October 2014 at 16:37

    Hi Jere, .NET 4.5.2 on that server. Had to do a manual update to get to that too, the Microsoft Updates were only going as far as 4.5.1.
    HTH, Mike

    ReplyDelete